Nepal Joins Have I Been Pwned: 135 Government Email Accounts Identified in Historical Data Breaches

Nepal has taken a significant step toward strengthening its national cybersecurity posture by officially joining Have I Been Pwned (HIBP), the world’s most widely used data breach monitoring platform. The move has already borne fruit and exposed a serious problem. Within days of onboarding, authorities confirmed that 135 official government email accounts under the nepal.gov.np domain have appeared in historical data breaches, some of which are now being actively exploited in phishing campaigns targeting senior officials.

Thank you for reading this post, don't forget to subscribe!

This article breaks down what happened, why it matters, and what it means for the future of Nepal’s digital security.

What Is Have I Been Pwned, and Why Does It Matter?

Have I Been Pwned is a free breach-notification service created by security researcher Troy Hunt. It aggregates data from thousands of publicly known data breaches and lets individuals, companies, and now governments check whether their email addresses or domains have been exposed. Beyond the free consumer search tool, HIBP runs a dedicated government service that gives national Computer Emergency Response Teams (CERTs) and cybersecurity agencies API-level access to monitor every email address under their official domains and get alerted the moment new breach data affecting them surfaces.

Nepal becoming the 47th government to join this program puts it in the same company as nations like Bangladesh and Costa Rica, both of which onboarded earlier this year through their national CERT/CSIRT agencies.

Nepal’s National Cyber Security Centre Takes the Lead

The onboarding was carried out by Nepal’s National Cyber Security Centre (NCSC), which now has direct API access to query all government domains against HIBP’s breach database. This is a major upgrade from the country’s previous, largely reactive approach to breach detection where compromises were often discovered only after damage had already been done, such as through leaked data dumps or public reports from independent researchers.

With HIBP integration, the NCSC can now:

• Identify which government email addresses have already been exposed in past breaches
• Receive near real-time alerts whenever new breach data implicates a .gov.np address
• Prioritize password resets and credential hardening for the most sensitive accounts
• Build a clearer, evidence-based picture of Nepal’s exposure across the public sector

135 Government Accounts Found Compromised

The first scan under the new system turned up sobering results: 135 official addresses under the nepal.gov.np domain were found in various historical data breaches. These weren’t accounts belonging to minor departments — the exposed addresses reportedly trace back to some of the most sensitive institutions in the country, including:

• The Office of the Prime Minister and Council of Ministers
• The Ministry of Home Affairs
• The Ministry of Finance
• The Ministry of Foreign Affairs

Because these accounts were exposed in breaches unrelated to any Nepal government system directly, the leaks likely stem from credential reuse — officials using their official government email addresses to sign up for third-party websites and services that were later breached. Once an email/password combination is leaked, attackers routinely test it across other platforms, including official government email portals, in what’s known as credential stuffing.

Phishing Campaigns Already Exploiting the Exposure

The consequences of this exposure are not hypothetical they’re already unfolding. Nepal has seen a wave of phishing emails impersonating senior government and police officials in an apparent effort to intimidate and defraud recipients.

In one documented case, scammers forged emails under the identity of Additional Inspector General of Nepal Police, Manoj Kumar KC, falsely claiming the recipient’s IP address had been linked to illegal online content. The fraudulent messages threatened prosecution by the Central Investigation Bureau and warned of imminent court action unless the recipient responded immediately a classic scare tactic used to pressure victims into paying money or handing over personal information before they have time to think it through.

Similar fake circulars have circulated using the identities of the Prime Minister’s Office and multiple Deputy Inspector Generals of Police. Officials at the NCSC have confirmed that even cybersecurity personnel themselves have received these targeted phishing attempts, underscoring how convincing and widespread the campaign has become.

Why This Isn’t Nepal’s First Brush With Data Exposure

Nepal’s digital ecosystem has faced repeated breaches over the years. Government websites were compromised as early as 2017, when a hacker group calling itself “Paradox Cyber Ghost” reportedly breached dozens of government sites simultaneously. More recently, 2025 saw a series of major leaks exposing the personal records of millions of Nepali citizens including citizenship numbers, phone numbers, addresses, and scanned identity documents tied to the country’s rapid digitization under the Digital Nepal Framework.

Against this backdrop, the HIBP integration isn’t just a technical upgrade it’s a long-overdue move toward proactive, rather than reactive, cybersecurity.

What This Means for Nepali Citizens and Government Employees

If you work for a government agency or interact with .gov.np services, this development is a timely reminder to tighten your personal cyber hygiene:

1. Never reuse passwords across personal and official accounts. A breach on an unrelated website can compromise your government email if you’re recycling credentials.
2. Enable multi-factor authentication (MFA) on all official and personal accounts wherever it’s offered.
3. Verify unusual emails independently. If you receive a message threatening legal action or demanding urgent action especially one that appears to come from a senior official confirm it through a separate, trusted channel before responding.
4. Check your own exposure using the free Have I Been Pwned search tool to see if your personal email has appeared in known breaches.
5. Report suspicious emails to your IT/security team or the National Cyber Security Centre rather than replying directly.

The Road Ahead

Joining Have I Been Pwned is a meaningful first step, not a finish line. Continuous monitoring only works if it’s paired with strong internal policies: mandatory password resets for exposed accounts, phishing-awareness training for civil servants, stricter email authentication standards (like DMARC, SPF, and DKIM) to prevent spoofed emails from reaching inboxes in the first place, and a rapid-response protocol when new exposures are detected.

Nepal’s National Cyber Security Centre now has the visibility it previously lacked. What happens next how quickly compromised credentials are rotated, and how effectively phishing campaigns are shut down will determine whether this becomes a genuine turning point for the country’s cybersecurity or just another headline.

FAQs