Central bank shuts its website over a cyber threat, and seven banks pull online services
Nepal Rastra Bank temporarily closed its website and other services on Friday, citing a possible cybersecurity threat, Clickmandu and OnlineKhabar reported. It said essential information would go out on its official social media accounts.
The central bank told banks, financial institutions, payment system operators, payment service providers and remittance companies to tighten security and step up monitoring, Clickmandu reported. Seven banks closed their websites or some online services, going by the notices Bizshala counted: Global IME, Machhapuchchhre, Nabil, NIC Asia, Nepal Investment Mega, Prime Commercial and Siddhartha. What each shut differed. Prime closed five online portals, while Nabil said its GenAlpha app was affected.
The closures followed two serious flaws found in PHP, a programming language that runs many websites, though not every bank notice names it. Fixes were released on October 21, Merolagani reported. Government websites had already gone offline on Thursday, OnlineKhabar reported then.
The central bank's spokesperson said the sites were closed as a precaution, and that a site being offline does not mean it was hacked, Kantipur and The Kathmandu Post reported. OnlineKhabar quoted the bank as saying people's money and information are safe. QR payments and mobile banking kept working, Nepal Bankers' Association president Santosh Koirala told the Post. Some banks had their websites back by Friday. The Employees Provident Fund and the Social Security Fund also took their sites down.
Why it matters: No report gives a date for the central bank's website to come back, or a count of affected banks beyond the seven Bizshala documented. Other outlets say only that most banks issued similar notices.