Cybersecurity in Nepal (2026): Latest Cyber Attacks, Threats & Protection Guide

On the morning of January 1, 2024, hundreds of Nepal government websites went dark simultaneously. Immigration portals, passport services, land administration systems, and ministry websites all went offline within hours the result of a massive Distributed Denial of Service (DDoS) attack on the Government Integrated Data Centre (GIDC). Passengers at Tribhuvan International Airport faced long queues as immigration servers stopped responding. Flights were delayed. Border processing stalled.

Thank you for reading this post, don't forget to subscribe!

The attackers were not stopped by Nepal’s digital defenses because for too many critical systems, those defenses barely existed. Investigators later found that several affected government portals lacked even basic protections like proper firewalls and rate-limiting.

This was not an isolated incident. In mid-2025, the Ministry of Education’s systems were breached, with names, phone numbers, citizenship numbers, and academic records of thousands of students and staff stolen and sold on dark web forums. The Passport Department suffered a malware attack. The National Vigilance Center lost five months of property registration data in a hack. And a hacker group publicly claimed to have exfiltrated over two million records from Nepal Police’s portal citizenship certificates, passport scans, biometric-linked data offering them for sale for as little as $50.

Cybersecurity in Nepal is no longer a technical concern reserved for IT departments. It is a national emergency that touches every citizen, every business, and every government service.

In this guide, you will get a clear picture of the current threat landscape, the real incidents that have shaped it, why Nepal remains highly vulnerable, and what individuals and organizations can do to protect themselves right now.

What is Cybersecurity?

Cybersecurity is the practice of protecting digital systems, networks, devices, and data from unauthorized access, theft, damage, or disruption.

Think of it as the digital equivalent of physical security. A physical lock protects your home. A firewall protects your server. Strong passwords protect your accounts. Encryption protects your data in transit. Cybersecurity is the discipline that designs, implements, and maintains these protections and finds the gaps before attackers do.

In Nepal’s context, cybersecurity matters because virtually every essential service banking, passports, land registration, academic credentials, mobile payments now lives on digital infrastructure. When that infrastructure is insecure, it is not just data at risk. It is people’s money, identity, safety, and trust in the systems that are supposed to serve them.

The Current Cybersecurity Landscape in Nepal

Nepal’s digital transformation has been rapid. As of 2025, the country has over 16.5 million internet users approximately 55.8 percent of the total population up from under 10 million just five years ago. There are over 39 million mobile connections, exceeding the national population. Social media users number over 16 million, with Facebook and Messenger alone accounting for the vast majority.

This digital growth has created enormous opportunity. It has also created an enormous attack surface.

Banking has moved online. Government services are delivered through digital portals. Mobile wallets like eSewa and Khalti process millions of transactions daily. Citizens increasingly store personal and financial information in digital systems often without fully understanding the risks.

Meanwhile, the systems protecting this infrastructure have not kept pace. The Electronic Transactions Act that governs digital crime was drafted in 2006 and 2008 before social media existed in its current form, before cryptocurrency, before AI-powered fraud. Nepal’s Cyber Bureau, the primary institution tasked with fighting cybercrime, operates with only 106 personnel, of which just 28 are trained IT professionals. They handle 60 to 70 complaints per day with no dedicated forensic laboratory.

The result is a widening gap between the scale of digital threats and the capacity to address them and cybercriminals are exploiting that gap every single day.

Latest Cyber Attacks in Nepal (Core Section)

These are not hypothetical scenarios. These incidents happened, and their consequences are still being felt.

DDoS Attack on the Government Integrated Data Centre (January 2024)

Nepal’s government main server faced cyberattacks leading to disruptions of hundreds of government websites across the country. The attack overwhelmed the GIDC with massive coordinated traffic, taking down over 400 government websites simultaneously. Immigration and passport databases went offline, disrupting services and inconveniencing thousands of passengers at Kathmandu airport.

The investigation revealed that the security tools used to protect many of these sites had expired licenses. Basic defenses like rate-limiting were absent on some of the country’s most critical public portals. The attack was a warning. For many observers, it was a warning that went unheeded.

Ministry of Education Breach and Dark Web Data Sale (Mid-2025)

In July 2025, the Ministry of Education’s website was compromised, making it one of the most concerning cyber incidents. Hackers were able to enter internal systems without authorisation and release private data belonging to thousands of workers and students. Names, phone numbers, emails, citizenship numbers, and even comprehensive academic records were stolen.

The stolen data was shared on Telegram channels and dark web forums in exchange for cryptocurrency a pattern that has become standard for Nepali data breach incidents. A reported 1.4 terabytes of structured data allegedly from the ministry’s central database surfaced on underground marketplaces.

Nepal Police Portal Breach and 2 Million Records Compromised (Late 2025)

In one of the most severe data breach incidents in Nepal’s history, a hacker collective publicly claimed responsibility for compromising the official Nepal Police portal. Over 2 million records including citizenship certificates, passport scans, and biometric-linked data were exfiltrated and offered for sale on dark web forums. The group cited “poor security practices” as the reason for the breach.

The implications extend far beyond embarrassment. Leaked citizenship data and biometric records can be used for identity fraud, SIM swapping, financial account takeover, and targeted phishing at scale.

Ministry of Federal Affairs Compromise by FunkSec (Early 2025)

FunkSec targeted Nepal’s Ministry of Federal Affairs and General Administration, advertising access to the super admin panels of government websites on their dark web platform. The breach exposed administrative records tied to federal and local governance. Nepal’s media confirms that Ministry spokesperson Kali Prasad Parajuli mentioned he was unaware of the breach highlighting a recurring and deeply concerning pattern: government departments often learn about their own breaches from cybersecurity researchers and media, not from internal detection.

Passport Department Malware Attack

The Passport Department suffered a malware attack that crippled its application system, causing significant delays in passport-related services. Citizens waiting for passport renewals and applications faced weeks-long disruptions as the department struggled to restore functionality. This attack affected one of the most frequently used government services in the country.

Tribhuvan University Online Exam Platform Breach (2024)

In February 2024, Tribhuvan University (TU) faced a significant cybersecurity incident when its newly launched online services system was compromised. Student data, academic records, and personal contact information were exposed. For a system that had just launched, the breach was a damaging blow to public confidence in digitized academic services.

Cross-Border Cybercrime Targeting Nepal

Nepal is not only a victim of attacks originating externally it has also become a hub for cross-border cybercrime operations. Indian police dismantled a cybercrime ring operating from Nepal and Cambodia. The group hacked Indian bank accounts and stole millions of rupees. Investigations revealed that Nepali citizens were being coerced into taking part in scams involving digital and cryptocurrency fraud.

In April 2025, a 20-year-old Nepali national, Prasan Nepal, was arrested in the US for leading a subgroup of the global cybercriminal network “764 Inferno,” involved in extortion and spreading malicious content, highlighting how Nepali youth are increasingly being drawn into international cybercrime networks sometimes as willing participants, often as coerced victims.

Cybercrime Statistics in Nepal

The numbers tell a story that should concern every policymaker, business, and citizen.

A total of 18,926 cybercrime cases were registered at the Cyber Bureau of Nepal Police over the past 12 months — an average of around 52 cases per day.

To understand how dramatic this rise is, consider the trajectory:

Fiscal Year	Reported Cases	Year-on-Year Change
2019/20	2,301	Baseline
2022/23	9,013	+292% from baseline
2023/24	19,730	+119% from prior year
2024/25	18,926	Slight dip (attributed to underreporting)

Financial scams and fraud alone made up 7,723 cases 40.82 percent of all reported cybercrimes representing an 87.82 percent increase from the previous year’s 4,112 cases, nearly doubling in a single fiscal cycle.

The bureau also logged 3,503 hacked accounts; 3,067 fake or impersonated accounts; 1,801 bullying and harassment complaints; and 1,026 criminal defamation cases.

Critically, these figures represent only reported cases. Many crimes, particularly those targeting women and girls, go unreported due to social stigma and hesitation to approach the police. The actual scale of cybercrime in Nepal is almost certainly significantly higher.

Only 0.5 percent of complaints result in legal action 52 prosecutions out of over 10,000 complaints in a measured period. For cybercriminals operating in Nepal, the odds of facing legal consequences remain remarkably low.

Common Types of Cyber Threats in Nepal

Phishing Attacks

Fake emails, SMS messages, and WhatsApp links mimicking banks, government agencies, and digital payment platforms. Victims are tricked into entering credentials on convincing fake pages. Facebook and Messenger remain the primary medium for cybercrime incidents, accounting for over 72 percent of all reported cases.

OTP Scams and Financial Fraud

Fraudsters pose as bank representatives, eSewa support, or government officials to extract one-time passwords from victims. Once the OTP is shared, funds are transferred within seconds. The rise of mobile banking has made this the fastest-growing crime category in Nepal.

Social Engineering and Impersonation

Criminals create fake social media profiles impersonating known individuals, officials, or celebrities to build trust and extract money or personal information. 3,067 fake or impersonated account cases were registered in fiscal year 2024/25 alone.

Malware and Ransomware

Malicious software delivered through email attachments, fake app downloads, or compromised websites infects devices and systems. The Passport Department’s disruption was caused by malware that crippled core application systems.

Sextortion and Blackmail

A deeply damaging form of cybercrime that disproportionately targets women and young people. Perpetrators obtain or manipulate intimate images and threaten to publish them unless demands are met. Women make up 44.32 percent of all cybercrime victims in Nepal, often targeted through blackmail, harassment, revenge porn, and online impersonation.

Cryptocurrency and Investment Scams

Rising cases of fake crypto investment schemes, with losses averaging NPR 250,000 per victim in 2024. These schemes typically promise extraordinary returns to lure victims into transferring money to fraudulent platforms.

Why Nepal Remains Vulnerable to Cyber Attacks

Outdated Legal Framework

The Electronic Transactions Act (ETA) of 2006 remains the foundational legal document a law conceived in a very different digital era. This legislation fails to address modern-day threats such as deepfakes, cryptocurrency scams, and AI-generated impersonation. Nepal has drafted a National Cyber Security Policy (2023), but comprehensive cyber legislation that meets current threat realities is still pending.

Severely Under-Resourced Cyber Bureau

The Cyber Bureau has only 106 personnel 28 IT experts handling 60 to 70 daily complaints. This creates a 1:650 investigator-to-complaint ratio. Without adequate staffing, forensic tools, and budget, investigations are slow and prosecution rates remain abysmally low.

Low Digital Literacy

62 percent of victims had no cybersecurity awareness training according to a 2024 Cyber Bureau survey. When most new internet users in Nepal do not understand basic concepts like OTP security, phishing recognition, or safe app installation, social engineering attacks succeed with near-complete reliability.

Fragmented Government Security

There is a notable lack of a cohesive, centralized strategy for cyber defense. Each department often handles its own security, leading to a fragmented and ineffective defense. The result is inconsistent standards across ministries — where one department may have reasonable protections and an adjacent one runs unpatched systems with default configurations.

International Cooperation Barriers

Only 3 mutual legal assistance treaties exist, hindering tracking of transnational cybercriminals operating from India, China, or Nigeria. When cybercriminals operate across borders as they increasingly do Nepal’s limited international legal framework makes prosecution nearly impossible.

Impact of Cyber Attacks in Nepal

Financial Loss at Scale: Billions of Nepali rupees are lost annually to digital fraud. Individual victims lose savings, retirement funds, and business revenue often with no realistic path to recovery given low prosecution rates.

Identity Theft and Permanent Data Exposure: The leak of citizenship numbers, passport scans, and biometric data is not a temporary inconvenience. That data is permanently compromised. Victims face years of elevated risk for SIM swapping, account takeover, and targeted fraud.

National Security Risks: When immigration databases, passport systems, and government coordination platforms are disrupted or compromised, the consequences extend to border security, legal verification processes, and the integrity of official records.

Collapse of Public Trust: Every high-profile breach especially those involving citizen data held by the government erodes trust in digital services. This is counterproductive at a moment when Nepal needs citizens to engage with digital government platforms.

Gender-Specific Harm: Sextortion, blackmail, and image-based abuse cause psychological trauma that extends far beyond financial loss. The underreporting of these crimes means the true scale of harm remains invisible in official statistics.

Government Efforts and Laws

Electronic Transactions Act (ETA)

Nepal’s primary legislation covering electronic crimes. Originally passed in 2006 and updated in 2008, it criminalized unauthorized computer access, electronic fraud, and misuse of data. However, it predates social media, mobile banking, cryptocurrency, and AI-generated crime making it increasingly inadequate for the current threat environment.

Nepal Police Cyber Bureau

Established in 2018, the Cyber Bureau is the central institution for cybercrime investigation and prevention. It handles complaints, conducts investigations, coordinates with international agencies, and runs public awareness programs. Despite clear dedication, the Bureau is chronically underfunded and understaffed relative to the scale of the problem it faces.

National Cyber Security Policy (2023)

Nepal released a 102-point advisory and a National Cyber Security Policy in 2023, outlining frameworks for protecting critical infrastructure and promoting digital safety. Implementation and enforcement remain inconsistent across government departments.

Challenges in Enforcement

The gap between policy and practice is wide. Prosecutors lack technical expertise. Courts are unfamiliar with digital evidence standards. International coordination is hampered by limited treaties. And the resource constraints on the Cyber Bureau mean that even well-documented cases can take years to reach any resolution.

How Individuals Can Stay Safe

These protections are simple, free or low-cost, and effective against the majority of cybercrime methods currently active in Nepal.

Enable Two-Factor Authentication (2FA) everywhere. For eSewa, Khalti, email, and social media accounts, enable 2FA using an authenticator app rather than SMS wherever possible. This prevents account takeover even if your password is compromised.

Never share OTPs. No bank, digital wallet, government office, or customer support representative has any legitimate reason to ask for your OTP. If someone asks regardless of how official they sound the call is a scam. Hang up.

Verify before clicking. Do not click links in SMS, WhatsApp, or Facebook messages claiming to be from banks, government agencies, or digital payment platforms. Open apps directly or type URLs manually.

Use strong, unique passwords. A different password for every account means that one breach does not cascade into ten. A password manager makes this practical without requiring you to memorize dozens of complex strings.

Keep devices updated. Software updates fix known security vulnerabilities. An unpatched phone or computer is significantly easier to compromise than a current one.

Check app permissions carefully. An app that requests access to your SMS messages, contacts, or camera without a clear reason for needing them should be deleted. These permissions give apps access to your OTPs and personal data.

Report cybercrime promptly. Contact Nepal Police Cyber Bureau at 01-4416060 or submit complaints through their online portal. The faster a report is filed, the higher the chance of investigation and any potential recovery.

How Businesses Can Improve Security

Nepal’s private sector banks, fintech companies, telecoms, hospitals, schools faces the same threat environment as the government, often with less security investment than the scale of their digital operations requires.

Conduct regular security audits. Engaging ethical hackers or penetration testing firms to assess your systems proactively is far less expensive than responding to a breach after the fact. Make audits a scheduled, recurring activity not a one-time event.

Train employees on cybersecurity basics. The majority of successful breaches begin with a phishing email or social engineering call. A workforce that recognizes these attacks is your most cost-effective defense. Awareness training should be mandatory and updated regularly.

Implement incident response planning. Know in advance who does what when a breach occurs. Time lost in the first hours of an incident dramatically increases damage. A documented response plan, tested before it is needed, reduces both the scope of harm and the time to recovery.

Enforce access control principles. Employees should only have access to the data and systems their role requires. When credentials are compromised which happens the blast radius is contained.

Keep systems patched and updated. Many of Nepal’s most serious government breaches exploited known vulnerabilities in unpatched systems. There is no excuse for running critical infrastructure on software with publicly known security flaws.

Future of Cybersecurity in Nepal (2026 and Beyond)

Despite the concerning current landscape, there are meaningful reasons for cautious optimism.

Ethical hacking and bug bounty are emerging. A growing number of Nepali security researchers are building careers in ethical hacking, bug bounty programs, and penetration testing finding vulnerabilities before malicious actors do. This homegrown talent is exactly what Nepal needs to build long-term resilience.

Legislative reform is underway. Nepal’s draft Cybersecurity Bill aims to modernize the legal framework defining cyber offenses clearly, mandating disclosure standards, and addressing threats like deepfakes and cryptocurrency crime. If passed and properly implemented, it would significantly strengthen the legal foundation for enforcement.

Demand for security professionals is growing rapidly. Both public and private sector organizations are increasingly recognizing that cybersecurity is not optional infrastructure. Career opportunities for security professionals in Nepal from SOC analysts to application security engineers are expanding alongside this recognition.

Regional and international cooperation is increasing. Nepal’s engagement with INTERPOL cybercrime units and bilateral cooperation on transnational fraud investigations is slowly improving, creating more pathways for cross-border case resolution.

The trajectory is not inevitable, though. Meaningful improvement requires sustained investment, legislative action, and a cultural shift in how both government and citizens think about digital security.

CyberSamir Expert Tip

The single most important thing Nepal can do right now at every level, from individual citizen to government ministry is make cybersecurity everyone’s responsibility, not just IT’s.

Most of the breaches and frauds documented in this article did not require sophisticated hacking. They succeeded because of expired security licenses, absent firewalls, unpatched systems, and citizens who shared OTPs on request. These are not technical failures. They are awareness and accountability failures.

For individuals: save the Cyber Bureau number (01-4416060) in your phone today. Enable two-step verification on every account that offers it. Treat any unexpected OTP or anyone asking for one as an alarm signal, not a verification step.

For organizations: the next breach you face is probably not coming through zero-day exploits or state-sponsored hackers. It is coming through a phishing email to an employee who was never trained to recognize one, or through a system that someone meant to patch last quarter. Fix the basics first. Patch systems. Train staff. Test your defenses before attackers do.

Cybersecurity in Nepal will only improve when the people building and using digital systems care as much about protecting them as they do about expanding them.

Key Takeaways

• Cybersecurity in Nepal is at a critical juncture rapid digital expansion has created enormous opportunity and enormous risk simultaneously.
• Over 18,900 cybercrime cases were reported in fiscal year 2024/25 approximately 52 per day with financial fraud nearly doubling year-on-year.
• Real incidents in 2024–2025 include: the GIDC DDoS attack taking 400+ government sites offline, the Ministry of Education breach, a 2-million-record Nepal Police portal compromise, and the Passport Department malware attack.
• Only 0.5 percent of cybercrime complaints result in legal action an enforcement crisis that emboldens criminals.
• The Electronic Transactions Act is outdated, the Cyber Bureau is critically under-resourced, and digital literacy among the general population remains low.
• The most common threats are OTP scams, phishing, social engineering, fake accounts, and financial fraud all preventable with basic awareness.
• Individuals can protect themselves with 2FA, OTP discipline, secure passwords, and prompt reporting to the Cyber Bureau.
• Businesses need mandatory staff training, regular security audits, and incident response planning.
• Nepal’s draft Cybersecurity Bill and growing ethical hacking community offer a path toward meaningful improvement if the investment and political will follow.

The picture painted by Nepal’s cybersecurity landscape in 2026 is urgent but it is not hopeless. Every data breach, every scam victim, every disrupted government service is a consequence of gaps that are known, documented, and in most cases technically solvable.

What is required is a shift in priority. Cybersecurity in Nepal must move from the margins of policy agendas to the center. Government systems that hold the personal and biometric data of millions of citizens must be secured to a standard proportional to that responsibility. Digital literacy must become part of how the country prepares its citizens for the internet, not an afterthought.

For individuals reading this, the gap between vulnerable and protected is not large. Enable two-step verification. Never share your OTP. Report anything suspicious to the Cyber Bureau. These actions take minutes and significantly reduce your exposure to the most common threats.

The digital future Nepal is building is worth protecting. The tools, the knowledge, and the talent to protect it exist. The question is whether the urgency will match the scale of the challenge before the next major incident forces the issue.

• Internal Linking :
• CSRF & Open Redirect Vulnerabilities explained
• Social engineering attacks
• CORS Misconfiguration

Cybersecurity in Nepal is becoming increasingly important as cybercrime cases continue to rise, with reports showing nearly 52 incidents daily, including phishing, OTP scams, and data breaches. According to Nepal Police Cyber Bureau, online fraud and social engineering attacks are among the most reported threats affecting both individuals and businesses. Globally, organizations like Interpol also warn that cybercriminals are rapidly evolving their tactics, making awareness and preventive measures more critical than ever. Understanding these risks and staying informed can significantly reduce your chances of becoming a victim in 2026.