Case study report on cybersecurity breach

The case below is an illustrative (imagined) one; the names and figures are invented.

Abstract

This case study examines a ransomware attack on Himalaya Commercial Bank (a fictitious bank) on 12 March 2026. An employee opened a phishing e-mail, and malware spread through the network, encrypting the servers that held customer records and stopping online banking for 52 hours. The attackers demanded a ransom in cryptocurrency, which the bank refused to pay. Data was restored from backups, but the last six hours of transactions had to be rebuilt manually. About 18,000 customers were affected, and the bank lost around Rs. 6 crore in revenue, penalties and recovery costs. The study identifies weak e-mail filtering, outdated software, a flat network design and a lack of staff training as the main causes, and draws lessons for other organisations.

Findings

1. Entry point: a phishing e-mail with a fake invoice attachment was opened by a staff member in the accounts section.
2. Spread: the malware exploited a server vulnerability that had been left unpatched for six months, and moved through a flat network with no separation between departments.
3. Detection: there was no intrusion detection system; the problem was noticed only when files could not be opened.
4. Response: the incident response plan was out of date, and the first 4 hours were lost in confusion about who should take decisions.
5. Backup: daily backups existed, but restoring from them had never been tested, and the restoration took 40 hours.
6. Impact: services were down for 52 hours; 18,000 customers could not use cards or mobile banking; the loss was Rs. 6 crore; and the bank's image suffered, with customers withdrawing about Rs. 15 crore in the following week.
7. Reporting: the bank informed the regulator, Nepal Rastra Bank, and the police Cyber Bureau only after two days.

Discussion

The attack shows that human error and poor technical hygiene together cause most breaches. A single click was enough because the network was not segmented and the system was not patched. The refusal to pay the ransom was correct, as payment does not guarantee recovery and it encourages crime, but it was possible only because backups existed. However, the untested backups and the slow response made the damage worse.

The case also shows that the cost of an attack is more than the direct loss: customer trust, legal penalties and staff time matter too. Prevention is much cheaper than recovery. The main lessons are to train staff regularly to recognise phishing, to patch systems quickly, to separate the network into zones, to monitor the network, to test backups and to practise an incident response plan. Banks in Nepal, where digital services are growing rapidly, should follow the central bank's cyber resilience guidelines and share information about threats among themselves.