As a cybersecurity researcher in Nepal, I have spent years tracking the evolution of digital threats. For a long time, the dangers were relatively straightforward: simple phishing emails, basic scams, and the occasional website defacement. But as I stand here in late 2025, I am witnessing a disturbing and rapid transformation. The landscape has shifted from isolated incidents to a sophisticated, organized, and deeply malicious underground economy.

At the heart of this dark new reality are encrypted messaging apps, with Telegram emerging as the undisputed digital black market for criminals in Nepal. It has become a bustling, clandestine bazaar where the most sensitive and private data of Nepali citizens is being bought, sold, and traded with alarming impunity.

This isn’t a theoretical threat happening in some distant country. This is happening right now, in Nepal, to our friends, our family, and our fellow citizens. It’s time to shine a light on this hidden crisis, to understand how these markets operate, and to face the devastating consequences they have for our society.

Why Telegram? The New Digital Underworld

Criminals flock to the path of least resistance, and in Nepal’s digital space, that path now runs through Telegram. The platform’s features, designed for privacy, have been co-opted by those with malicious intent for several key reasons:

• Anonymity: Users can operate with pseudonyms, hiding their real identities behind a veil of secrecy.
• Accessibility: The app is free, easy to use, and available on every device, making it simple to set up a marketplace.
• Channels and Groups: Criminals use public “channels” to advertise their illicit goods to a wide audience. The actual transactions and data exchanges then happen in private, invite-only “groups,” making them difficult for law enforcement to infiltrate.
• Large File Sharing: Telegram allows the transfer of huge files (up to 2GB), making it trivial to share massive data dumps containing thousands of records or large collections of videos.

The Disturbing Inventory: What is Being Sold?

The goods for sale in these Telegram channels are not just usernames and passwords. They represent the most private aspects of our lives, now commodified and sold for a few thousand rupees.

1. Non-Consensual Intimate Imagery (NCII)

This is the most vile and damaging trade. “Revenge p*rn,” intimate photos, and private videos of individuals overwhelmingly women are stolen and leaked. This content is sourced from hacked social media accounts, compromised personal devices, or from former partners. It is then sold, traded, and spread across these channels, leading to blackmail, sextortion, and unimaginable psychological trauma for the victims.

2. Personal Citizen Data (Our “Nagarikata”)

Personally Identifiable Information (PII) is a hot commodity. We are seeing entire “KYC (Know Your Customer) packages” for sale. This includes high-resolution scans of:

• Citizenship cards
• Driver’s licenses
• Passports
• Personal photos

This data is the key to identity theft. With it, a criminal can attempt to open bank accounts, take out loans, or perpetrate other forms of fraud in someone else’s name.

3. Compromised Digital Wallets and Banking Credentials

Login details for popular digital wallets like eSewa and Khalti, as well as credentials for mobile banking applications, are regularly sold. These are typically obtained through targeted phishing attacks, where a victim is tricked into entering their details on a fake website. The criminals then sell these logs to others who drain the accounts.

How Do the Leaks Happen?

This flood of data doesn’t come from a single, massive government hack. It trickles in from thousands of smaller, often unnoticed breaches.

• Breaches of Small & Medium Businesses: This is the biggest source. Think of all the places you’ve submitted your KYC documents: internet service providers (ISPs), educational consultancies, local e-commerce sites, and small financial co-ops. Many of these businesses lack the resources and expertise to implement robust cybersecurity, making them soft targets for hackers who steal their customer databases.
• Phishing & Social Engineering: Still the number one way individual accounts are compromised. A single convincing fake email is all it takes for a user to give away their password.
• Malware & Spyware: Malicious software on a phone or computer can silently steal photos, messages, and login credentials directly from a device.

The Uphill Battle for Law Enforcement

The Nepal Police’s Cyber Bureau is fighting this battle, but they face immense challenges:

• Anonymity and Jurisdiction: Unmasking anonymous Telegram users is technically difficult. Furthermore, if the criminal is operating from outside of Nepal, jurisdiction becomes a major hurdle.
• Outdated Legal Frameworks: Our primary cyber law, the Electronic Transactions Act of 2008, was written for a different era. It is ill-equipped to handle the scale and nature of modern, organized cybercrime.
• Lack of Mandatory Breach Disclosure: In Nepal, companies are generally not required to publicly report a data breach. This means that when a company is hacked and its customer data is stolen, the victims are often the last to know, leaving them vulnerable and unaware.

A Call to Action for a Safer Digital Nepal

The dark reality is that a sophisticated and harmful black market for Nepali data is no longer a future threat—it is here, and it is thriving. Ignoring this problem is not an option. We need a collective, society-wide response.

To Individuals: You are your own first line of defense.

• Be Vigilant: Question every unsolicited message. Think before you click any link.
• Use Strong Security: Use long, unique passwords for every account and enable Two-Factor Authentication (2FA) wherever possible.
• Be Stingy with Your Data: Think carefully before you give your KYC documents to any service. Ask how they will protect it.

To Businesses: You are the custodians of your customers’ data. Protecting it is not an IT problem; it is a fundamental business responsibility.

• Invest in Security: Implement basic security measures. Hire professionals to conduct security audits (VAPT).
• Minimize Data Collection: Don’t collect data you don’t absolutely need.

To Policymakers: Our legal and regulatory frameworks must evolve.

• We Need a Modern Data Protection Act: A strong law that holds companies accountable for protecting user data is urgently needed.
• Mandate Breach Disclosure: Companies must be required to inform their customers and the authorities when a data breach occurs.

The trust in our digital ecosystem is eroding. To realize the vision of a “Digital Nepal,” we must first make it a “Secure Nepal.” This battle cannot be won by the police alone. It requires a united front from all of us.