--- title: "Case study report on cybersecurity breach" subject: "Communication English" chapter: 9 key: "semester_5/communication_english:case-study-cybersecurity-breach" source: https://www.bctengineer.com/q/semester_5/communication_english/case-study-cybersecurity-breach site: BCT Engineering --- # Case study report on cybersecurity breach Communication English · Chapter 9: Formal Reports - Asked in: 2082 Kartik (new course), 6 marks; 2081 Chaitra (new course), 6 marks (asked 2 times) - Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14 - Page: https://www.bctengineer.com/q/semester_5/communication_english/case-study-cybersecurity-breach - Whole chapter: https://www.bctengineer.com/md/semester_5/communication_english/chapter-9 ## Question Prepare a report of a case study of a cybersecurity breach and its consequences. Write abstract, finding and discussion parts only. ## Short answer A phishing email led to a ransomware attack on a bank, encrypting servers and causing a 52-hour outage affecting 18,000 customers, with a loss of Rs. 6 crore. The attack succeeded due to unpatched software and a flat network. Discussion stresses phishing training, patch management, network segmentation, tested backups, and incident response planning. ## Answer The case below is an illustrative (imagined) one; the names and figures are invented. #### Abstract This case study examines a ransomware attack on Himalaya Commercial Bank (a fictitious bank) on 12 March 2026. An employee opened a phishing e-mail, and malware spread through the network, encrypting the servers that held customer records and stopping online banking for 52 hours. The attackers demanded a ransom in cryptocurrency, which the bank refused to pay. Data was restored from backups, but the last six hours of transactions had to be rebuilt manually. About 18,000 customers were affected, and the bank lost around Rs. 6 crore in revenue, penalties and recovery costs. The study identifies weak e-mail filtering, outdated software, a flat network design and a lack of staff training as the main causes, and draws lessons for other organisations. #### Findings 1. **Entry point:** a phishing e-mail with a fake invoice attachment was opened by a staff member in the accounts section. 2. **Spread:** the malware exploited a server vulnerability that had been left unpatched for six months, and moved through a flat network with no separation between departments. 3. **Detection:** there was no intrusion detection system; the problem was noticed only when files could not be opened. 4. **Response:** the incident response plan was out of date, and the first 4 hours were lost in confusion about who should take decisions. 5. **Backup:** daily backups existed, but restoring from them had never been tested, and the restoration took 40 hours. 6. **Impact:** services were down for 52 hours; 18,000 customers could not use cards or mobile banking; the loss was Rs. 6 crore; and the bank's image suffered, with customers withdrawing about Rs. 15 crore in the following week. 7. **Reporting:** the bank informed the regulator, Nepal Rastra Bank, and the police Cyber Bureau only after two days. #### Discussion The attack shows that human error and poor technical hygiene together cause most breaches. A single click was enough because the network was not segmented and the system was not patched. The refusal to pay the ransom was correct, as payment does not guarantee recovery and it encourages crime, but it was possible only because backups existed. However, the untested backups and the slow response made the damage worse. The case also shows that the cost of an attack is more than the direct loss: customer trust, legal penalties and staff time matter too. Prevention is much cheaper than recovery. The main lessons are to train staff regularly to recognise phishing, to patch systems quickly, to separate the network into zones, to monitor the network, to test backups and to practise an incident response plan. Banks in Nepal, where digital services are growing rapidly, should follow the central bank's cyber resilience guidelines and share information about threats among themselves. ## Check yourself The answer's key points as multiple-choice questions, with the correct option and why. 1. In the case study, how did the ransomware get in and spread through the bank? A. A phishing e-mail with a fake invoice was opened; an unpatched server and a flat network let it spread B. Attackers guessed the administrator password and then deleted the backups C. A stolen laptop was connected to the bank's network by an outsider D. An ATM was physically tampered with and infected the core server Answer: A. The breach began with a phishing attachment and spread because of an unpatched six-month-old vulnerability and a network with no separation between departments. (Key point: Entry point and spread) 2. The Discussion says refusing to pay the ransom was correct. What made refusal possible? A. The police recovered the data B. The bank had working backups from which data could be restored C. The attackers withdrew their demand D. The regulator paid the ransom Answer: B. Refusal was possible only because daily backups existed, although the untested backup made recovery slow (40 hours). (Key point: Why refusing the ransom was possible) 3. Which set of items belongs in the Abstract of this case study? A. Detailed list of recommendations for the central bank only B. A full list of references and appendices C. The incident, its main effects (52 hours down, 18,000 customers, Rs. 6 crore) and the main causes D. Only the name of the employee who clicked the e-mail Answer: C. The abstract summarises what happened, the impact and the causes in a short paragraph. (Key point: Abstract content) 4. According to the Discussion, which statement about the cost and lessons of the attack is correct? A. Only the direct financial loss matters B. Prevention is cheaper than recovery, and costs also include trust, penalties and staff time C. Testing backups is unnecessary if they run daily D. Staff training is less important than buying more servers Answer: B. The Discussion stresses hidden costs and lists lessons: training, patching, segmentation, monitoring, tested backups and a practised response plan. (Key point: Lessons and total cost) ## Related in Communication English - [Final project report: title page, abstract, recommendation](https://www.bctengineer.com/question.md?key=semester_5%2Fcommunication_english%3Afinal-report-title-abstract-recommendation) — Communication English, chapter 8 - [Report on micro hydro project (abstract to findings)](https://www.bctengineer.com/question.md?key=semester_5%2Fcommunication_english%3Areport-micro-hydro-project-manager) — Communication English, chapter 8 - [Final report on power house construction](https://www.bctengineer.com/question.md?key=semester_5%2Fcommunication_english%3Afinal-report-power-house-construction) — Communication English, chapter 8 - [Report on sound pollution in Kathmandu Valley](https://www.bctengineer.com/question.md?key=semester_5%2Fcommunication_english%3Areport-sound-pollution-kathmandu) — Communication English, chapter 9 - [Report on advancement in science and technology](https://www.bctengineer.com/question.md?key=semester_5%2Fcommunication_english%3Areport-advancement-science-technology-nepal) — Communication English, chapter 9 - [Report on causes of deforestation](https://www.bctengineer.com/question.md?key=semester_5%2Fcommunication_english%3Areport-causes-deforestation-hilly-nepal) — Communication English, chapter 9, asked 2× ## Related in other subjects - [Case study: revamping MBI system for CEO](https://www.bctengineer.com/question.md?key=semester_5%2Finstrumentation_ii%3Acs-ceo-revamp) — Instrumentation II, chapter 10 - [Case study: Nepal Electricity Authority / Telecom](https://www.bctengineer.com/question.md?key=semester_7%2Forganization_and_management%3Acase-study-nea-nt) — Organization and Management, chapter 9 - [Objectives of case study](https://www.bctengineer.com/question.md?key=semester_7%2Forganization_and_management%3Acase-study-objectives) — Organization and Management, chapter 9, asked 5× - [Case study: new system vs existing (cost, manpower)](https://www.bctengineer.com/question.md?key=semester_5%2Finstrumentation_ii%3Acs-cost-manpower-automation) — Instrumentation II, chapter 10, asked 4×