Ransomware Protection for Nepali Businesses

Every conversation about ransomware with a business owner arrives at the same point, usually within ten minutes. The owner stops asking how the attack happened and starts doing arithmetic. How much would they demand? Could we just pay, get the files back, and go on with the week?

In Nepal, that question has an answer most owners have never heard.

Paying is not a route Nepali law leaves open

Ransom demands are made in cryptocurrency. Cryptocurrency is banned in Nepal. Nepal Rastra Bank declared bitcoin transactions unlawful in August 2017, restated in September 2021 that using, trading and mining cryptocurrency are all illegal, and broadened that prohibition through further notices in 2022 and 2023. A petition asking the Supreme Court to give cryptocurrency legal recognition was dismissed in 2022, leaving the position intact. The penalties are real ones: fines of one to three times the value of the transaction, and imprisonment of up to three years.

Read that against a ransomware demand and the problem becomes obvious. A business in Kathmandu that scrambles to buy crypto so it can pay attackers is doing something the law prohibits on its face, and leaving a bank trail while doing it. No Nepali victim appears to have been prosecuted for paying, and no regulator has published a position on victims. Nothing in the ban carves out duress either. Plan on the basis that payment is not lawfully available to you.

International ransomware guidance is written for countries where paying is a bad idea. Here it is a bad idea and against the law. The practical consequence is that the whole debate about negotiating, which occupies so much of the global conversation, is closed before it starts. Recovery is the route you can actually rely on, which means the quality of your backups is not one control among many. It is the plan.

Paying rarely works even where it is permitted. The FBI and CISA state plainly in their joint advisories that payment does not guarantee files will be recovered. Nepal's own National Cyber Security Centre, set up by Cabinet decision in January 2024, issued a public advisory in April 2026 telling victims to refuse payment and restore from backups instead.

What an attack looks like in a business that runs on shared folders

Strip away the jargon and ransomware does two things. It scrambles your files so they cannot be opened without a key the attackers hold. And, increasingly, it copies those files out to the attackers before scrambling them, so they have something to threaten you with even if your backups are perfect.

For a large bank, that means locked servers. For a fifteen-person trading firm in New Road or a clinic in Lakeside, it usually means something more mundane. The accounts live in a spreadsheet on the finance person's laptop. Purchase records sit in a shared folder everyone maps as a drive letter. Customer contacts are split across a phone, a Viber group and someone's inbox.

In almost every first meeting after an incident, nobody can produce a list of where the business keeps its important information. Its memory turns out to live on two or three machines nobody ever called servers, and so nobody ever treated as critical.

Losing that access is not an IT inconvenience. It becomes a compliance problem the moment a VAT filing or tender deadline lands while the records are unreadable.

How attackers actually get in, and why the phishing advice is dated

For a decade, the standard answer was phishing. Train your staff to spot fake emails and you have handled most of the risk.

That advice has aged. Incident-response data published through 2026 keeps pointing somewhere else. Google's Mandiant team reports exploitation of software vulnerabilities as the most common way intruders first get in, ahead of email phishing by a wide margin, and it has held that position for several years running. Verizon's annual breach study puts vulnerability exploitation as the largest single category of initial access it tracks.

Staff training still matters, and phishing has not disappeared. Attackers have simply found the door easier to force than the people. Stolen and reused passwords now do a great deal of the work, often bought from brokers who specialise in nothing but selling access. For ransomware specifically, responders also point to access resold from an earlier, unrelated break-in, which is why an old incident you never fully cleaned up still matters.

For a small Nepali office, the exposed device is rarely a server. It is the router the ISP installed with its default admin password intact, the CCTV recorder somebody wired in four years ago and never updated, or the remote desktop left open so the accountant could work from home.

Here is the uncomfortable part. None of those is ever on anyone's list of IT assets, so none gets patched, and nobody feels responsible.

Backups: the one recovery path you fully control

The advice everyone repeats is the 3-2-1 rule. Three copies of your data, on two kinds of storage, with one kept off-site.

It is good advice with an odd history. An American photographer, Peter Krogh, popularised it in the mid-2000s while writing about protecting image libraries. It was never a government standard, and it was built for accidents: a dead drive, a stolen bag, a flood. Not for an opponent who hunts your backups on purpose.

That distinction matters, because modern attackers do exactly that. The UK's National Cyber Security Centre now advises that you should never have every backup connected at once, having seen too many organisations that genuinely had backups and lost all of them together because all of them were online when the encryption ran.

So the test is not whether you have a backup. It is whether you have one copy that a person sitting at a compromised computer, holding your administrator password, could not reach or destroy. In practice that means a drive disconnected after each copy, or storage where old versions cannot be overwritten even by an account with full rights.

Two failures show up again and again. The first is the USB drive left permanently plugged into the machine it is backing up, which is not a backup at all, just a second copy in the blast radius. The second is the backup nobody has ever restored from. Restoring one folder, once a quarter, tells you more than any amount of green ticks on a dashboard.

Backups have a limit that is easy to miss. They get your operations running again. They do nothing at all about stolen copies of your customer data already sitting on someone else's server. The NCSC is explicit that backups will not protect you from the extortion half of the problem, and points to separate guidance for it. If the threat is publication rather than deletion, restoring cleanly still leaves you with the harder conversation.

The quiet weeks before the screen changes

Ransomware feels instant. It is not. Attackers usually spend time inside a network before triggering encryption, mapping what is there, finding the backups and quietly widening their access. Median figures reported by incident responders cluster around three to five days, though a meaningful share of attacks run from first foothold to encryption inside a single day.

Most guidance treats this as a detection problem. There is a second implication that gets less attention.

If an intruder was in your systems for two weeks, then your two-week-old backup may already contain whatever they left behind. Businesses that restore in a panic sometimes restore the attacker along with the files, and get hit again a fortnight later. This is the strongest argument for keeping backup history that reaches further back than you think you need, and for treating recovery as something to do carefully rather than fast.

Access, and the discipline of handing out less of it

Two controls do more than anything else on a limited budget, and neither is exciting.

The first is multi-factor authentication. Microsoft researchers, working from real sign-in telemetry rather than marketing estimates, published figures in 2023 showing it cut the risk of account compromise by around 99 percent, including for accounts whose passwords had already leaked. Few controls come close.

The honest complication is that MFA now fails on coverage rather than absence. Responders keep finding organisations that were breached through credentials despite having MFA switched on somewhere. Email had it. The VPN did not, or the firewall's admin page did not, or an old accounting application did not. Attackers do not attack your best-defended door.

That turns a vague instruction into something a business owner can actually audit. Sit down and list every way a person can log in to something of yours from outside the office. Email, remote desktop, the router's admin page, cloud accounting, the file-sharing service. Then check each one individually. The gaps are usually visible within twenty minutes.

The second control is refusing to give everyone administrator rights. Most staff never need to install software. When an ordinary user account is compromised, the damage is bounded. When an administrator account is compromised, the attacker inherits your whole network. Trimming this is free, and it is unpopular for about a week.

The first day, and who you actually call

If it happens, disconnect the affected machines from the network and from the internet, but resist the urge to wipe and reinstall immediately. Evidence of how they got in disappears with the rebuild, and without it you are likely to leave the same door open.

Then work out what you can still trust, before restoring anything onto a network you have not checked.

Reporting is where most Nepali guidance goes vague, so here it is concretely. The Nepal Police Cyber Bureau at Bhotahiti in Kathmandu is the operational body. It accepts complaints in person, by email, and through an online complaint form on its website. If you are outside the valley, district police offices accept cybercrime complaints and refer them onward for technical investigation, so a business in Pokhara does not need to travel to file. Nepal's National Cyber Security Centre asks victims to report to the Cyber Bureau and to notify the Centre as well.

Before paying anyone for a decryption tool, check No More Ransom, a free project run since 2016 by Europol, the Dutch national police and a group of security firms. It holds working decryptors for a long list of ransomware families. It will not cover the newest strains, but it costs nothing to check, and occasionally it ends the whole problem in an afternoon.

What Nepali law does and does not do for you

Nepal has no ransomware-specific offence. Prosecutions rely on the Electronic Transactions Act 2063, which covers unauthorised access to computer systems and damage to them, while the extortion itself falls under the general criminal code. The specialised IT Tribunal that the Act created was never actually constituted, so cybercrime cases are tried in the ordinary courts. Until 2023 that meant the Kathmandu District Court; a Nepal Gazette notice that year gave every district court jurisdiction under the Act.

The bigger gap sits in privacy law. The Privacy Act 2075 places no obligation on a private company to tell affected customers, or any regulator, that their data has been stolen. Nepal has no data protection authority to notify. The fine under the Act tops out at thirty thousand rupees, alongside up to three years' imprisonment and whatever compensation a district court thinks reasonable, and a complaint must be filed within three months of the offence being committed rather than three months from when the victim found out about it.

Draw the conclusion carefully. The scarcity of publicly confirmed ransomware cases in Nepal is not evidence that attacks are rare here. Nobody is required to report them, so almost nobody does. Silence is not the same as safety.

An absence of legal duty is also not an absence of consequence. Banks, suppliers and larger clients increasingly ask questions before they connect their systems to yours, and losing a customer's data is a commercial event whether or not it is a regulatory one. Cyber insurance has been available from licensed Nepali insurers since 2019, and more products have been approved recently. Wordings here are not published, so read what is covered carefully, and ask the insurer directly whether it would fund a ransom that is itself unlawful.

A realistic place to start

Nobody reads a list like this and does all of it. So do it in order.

Turn on MFA everywhere someone can log in from outside your office, starting with email and remote access. Get one backup copy that is genuinely disconnected, and prove it works by restoring something real. Patch or replace whatever of yours faces the internet, especially the router and any camera system. Take administrator rights away from staff who do not need them. Write down, on one page, who gets called if the screens go dark.

That is a weekend of work for a small business, and it closes most of the realistic paths an attacker would take. The sequencing matters more than the spending. At Webpal we push clients through those five items before discussing anything more sophisticated, because a well-configured basic setup beats an expensive tool sitting on top of an unpatched router.

Security is not a project with an end date. It is closer to maintenance: unglamorous, cheaper than the alternative, and mostly noticed only when it has been neglected.

Talk to Webpal about a practical security review of your systems. We will tell you honestly which of these gaps you have, what it would take to close them, and what you can safely leave for later.

Frequently asked questions

Is it illegal to pay a ransomware demand in Nepal?

Paying is not addressed directly by cybercrime law, but the mechanism is. Ransoms are demanded in cryptocurrency, and Nepal Rastra Bank has banned the use, trading and mining of cryptocurrency, a position left intact when the Supreme Court dismissed a 2022 petition seeking legal recognition for it. Acquiring crypto to pay attackers exposes a business to fines of one to three times the transaction value and up to three years' imprisonment, and the ban contains no exception for victims acting under duress. Treat payment as closed off and plan your recovery accordingly.

Where do I report a ransomware attack in Nepal?

The Nepal Police Cyber Bureau at Bhotahiti, Kathmandu is the body that investigates. It takes complaints in person, by email and through an online complaint form on its website. Businesses outside Kathmandu can file at their district police office, which refers cases onward. Nepal's National Cyber Security Centre also asks victims to notify the Centre in addition to reporting to the police.

Do I have to tell my customers if their data was stolen?

Nepal's Privacy Act 2075 does not require private companies to notify affected individuals or any regulator, and there is no data protection authority to report to. Licensed banks and financial institutions have separate obligations to Nepal Rastra Bank. For everyone else, disclosure is currently a commercial and ethical judgement rather than a legal one.

Will antivirus software stop ransomware?

It stops some of it, and it is worth having. It will not stop an attacker who logs in with a valid stolen password, because nothing about that looks like malware. Antivirus is one layer, not a solution, and it is a poor substitute for MFA, patching and tested backups.

How often should we back up?

Frequently enough that losing everything since the last copy would be survivable. For most small businesses that means daily. What matters more than frequency is that at least one copy is disconnected from the network, that you keep enough history to reach back past a long intrusion, and that you have actually restored from it at least once.

Is cloud storage the same as a backup?

Not automatically. A synced folder copies your changes immediately, which means it also copies the encryption. Cloud storage becomes a backup when it keeps previous versions that a compromised account cannot delete or overwrite. Check whether version history is switched on and how far back it reaches.

Are small businesses really targets?

Most ransomware is not aimed at anyone in particular. Attackers scan broadly for exposed systems and weak credentials, then work through whatever they find. Being small offers no protection from an automated scan. Be cautious with published statistics about small business victims, though. The most widely quoted survey, Sophos's annual State of Ransomware, samples only organizations with a hundred to five thousand staff, so it says very little about a typical Nepali firm.

Ransomware is one of the most serious cybersecurity threats facing businesses today. It can disrupt operations, lock access to important files, and cause significant financial and reputational damage. Fortunately, many attacks can be prevented by taking simple but effective security measures.