Data of 16 commercial bank employees and around 600 accounts related to system admins found on the dark web

 Data of 16 commercial bank employees and around 600 accounts related to system admins found on the dark web

Is your bank account really safe? Tekpana's research has exposed a serious security challenge in Nepal's banking system. During the research, more than 9,000 sensitive login details related to employees, system administrators and customers of 18 out of 20 commercial banks in Nepal were found on the dark web. Of these, around 600 account details are related to the bank's internal systems, which has exposed serious weaknesses in cyber security.

During the research, data of 16 out of 20 commercial banks' employees and system admins was found on the dark web. The remaining two banks that were leaked only have customer data. This data, including emails and passwords, can easily access sensitive data of some banks. During the investigation, data of employees and system admins of Nepal Bank, Rastriya Banijya Bank, Krishi Bikas Bank, Standard Chartered, Prime Commercial, Sanima, Himalayan, Nabil, Kumari, NMB, Global IME, Laxmi Sunrise, Prabhu, Citizens, NIC Asia and Nepal Investment Mega Bank was found on the dark web.

Analyzing the emails (usernames) and passwords of employees and system admins of 16 commercial banks found on the dark web, Nabil Bank, Rastriya Banijya Bank and Nepal Bank Limited were found to be the most vulnerable. A total of 1,676 data analyzed were found to be related to 569 unique accounts. The data related to the three banks mentioned above accounted for only 46 percent of it.

Of the passwords used by bank employees and admin systems, 25.4 percent were very weak. It was also found that they usually contain the employee's name, address and random numbers like 123, 678, etc. However, 19 percent of passwords are very complex. This data was leaked due to the negligence of employees or system admins.

Analyzing the leaked passwords, it was also found that the same password was used in many places. It has been found that some employees of the bank used the official email account of the bank and the same password to log in to other third-party platforms.

Among the 16 banks, Krishi Bikas Bank is a bank that uses the .gov.np domain extension, i.e. the government domain. 20 email accounts and passwords of this bank have been found on the dark web. These accounts have been leaked 119 times. The leakage of so much sensitive data from a government-owned bank has added further concern to the data security of the government sector.

The leaked details (usernames and passwords) are mostly related to Microsoft 365/Azer AD and the webmail login page of Office. Then, the details of the employee administration system (HR system), core banking, e-banking portal and Nepal Rastra Bank's financial reporting portal were found to be leaked in 11 cases.

System Admin Details

This is the most sensitive category included in this dataset. IT and system admin accounts have access to core banking systems, network management, the system for adding new users, or changing the passwords of other employees. Therefore, the theft of system admin accounts is considered many times more dangerous and sensitive than the theft of email details of ordinary employees.

According to this data, one system admin or IT employee account each from Sanima Bank, Kumari Bank, NIC Asia Bank, and Prime Commercial Bank has been leaked. In the case of Sanima Bank, details related to the same admin account appear to have been leaked a total of 5 times at different times. In addition, this account is such that it can be accessed on two third-party project platforms and three bank systems.

It is not clear what level of access the bank employees, whom we have categorized here as general staff (non-IT employees), had to their email accounts. Our analysis shows that this includes the ability to log in to the bank's core system, view or manage customer details, report to the National Bank, view customer complaints, and communicate.

Password usage patterns and trends

Out of 1,676 records found on the dark web, 569 accounts were found to be unique. This means that the number has reached 1,676 due to repeated leaks of these accounts. Of these, Nabil Bank is the most affected. 128 credential records of this bank have been leaked. Similarly, 60 of Rastriya Banijya Bank, 56 of Nepal Bank Limited, 52 of Sanima Bank, 50 of NMB Bank, and 43 of Kumari Bank have been leaked.

Among the banks affected at a medium level, 43 of Kumari Bank, 44 of Himalayan Bank, 31 of Citizens Bank International, 30 of NIC Asia, 31 of Prabhu, 20 of Krishi Bikas Bank, and 20 of Standard Chartered Bank Nepal have been leaked.

Similarly, only 1-1 credential record of Global IME, Prime Commercial, Nepal Investment Mega and Laxmi Sunrise appears to have been leaked. These records are related only to bank employees and system administration.

What kind of passwords do bank employees and system administrators use?

The passwords were extracted from the leaked data and studied by dividing them into three categories based on length and character structure. Looking at the overall sector, the average length of the leaked passwords is 12.3 characters. This average length appears to be slightly higher due to mandatory rules for keeping complex passwords in some banks.

However, employees were found to have a habit of using the same password repeatedly in many places. Looking at the strength of passwords in a total of 1,676 records, about 25.4 percent of the records used very weak passwords. These passwords were short and based on simple words or easily guessable patterns such as Password123, name@123, nepal123 and Admin@2022.

The largest number, 494 passwords, were 9 to 10 characters long. The second largest number was 337 passwords with 7 to 8 characters. The third largest number was 285 passwords with 11 to 12 characters, while 284 passwords were more than 15 characters long. Similarly, 93 passwords were found to have characters from 13 to 14.

12.4 percent of passwords contained the name of the bank concerned. 24.2 percent of passwords contained common digits such as 123, 456, 789. 5.1 percent of passwords contained only numbers.

In which systems were the leaked bank emails and passwords used?

This data (account, email and password) is a description of the leaked accounts used by bank employees to log in to various platforms. It shows in which systems the employee accounts are at risk.

The largest number of 148 accounts (21 percent) are from the Microsoft 365 / Azure AD login page used by bank employees. When these accounts are leaked, the bank's official emails, files and internal chat apps are directly at risk. Similarly, in second place, 104 (15 percent) accounts using the bank's official webmail (Outlook Web Access) have been leaked.

64 (9 percent) accounts from the HR / Recruitment system, which is used to recruit employees and keep attendance or salary records, have also been leaked. This includes one of the bank's own internal Human Resources Administration System (HRIS). This has exposed the personal and confidential details of employees.

Similarly, 22 accounts of the bank's core system (Core-banking) and e-banking and 14 accounts of payment gateways such as PhonePe are also included in the leaked data.

The most alarming thing is that 11 accounts belong to the login portal for sending financial reports to Nepal Rastra Bank. The leakage of such important accounts used to submit reports to the Rastra Bank is a major threat to the security of not only a single bank but also the entire banking sector of Nepal. Apart from this, 329 accounts of various other general websites and portals run by employees have also been leaked.

Nabil Bank

Out of a total of 608 records leaked from Nabil Bank, 128 are unique accounts. Of these, an employee's account is found in 36 records. Among the sensitive records leaked, emails related to cloud were leaked twice, emails related to customer care were leaked four times, an account named SL was leaked 18 times, and emails related to Nabil Invest were leaked six times. The rest are email accounts in the name of employees.

Of the leaked passwords, 29.6% were found to be very weak (short, simple or easy to guess), while only 3.9% were of strong standards. In addition, about 50.3% of the accounts were found to be using the same password repeatedly.

Rastriya Banijya Bank

60 email accounts related to employees and other corporates of Rastriya Banijya Bank have been leaked 178 times. Out of these, emails of Birgunj and Hetauda branches have been leaked once each, Pulchowk branches have been leaked twice, and Thapathali branches have been leaked 15 times. Similarly, emails related to training center and training feedback have been leaked once each. Emails related to mBanking, i.e. mobile banking of Rastriya Banijya Bank, have been leaked 6 times. Apart from these, the rest are employee emails. The email account of an employee of this bank has been found to have been leaked 22 times.

Of these leaked passwords, 44.3% are weak, while only 4% meet strong criteria. In addition, 57.4% of accounts have been found to have the same password repeatedly used.

Sanima Bank

The passwords of 52 different email accounts of this bank have been leaked 125 times. Sanima Bank is the bank whose admin account has been found on the dark web 5 times. Emails related to trading have been leaked 5 times and email accounts related to QR have been leaked 10 times. Similarly, emails related to CADC have been leaked 3 times. An employee of this bank has been found to have the email leaked 22 times. Apart from these, the other accounts are accounts in the name of employees.

Of these, 30.9% of passwords have been found to be weak, while 7.3% of passwords are strong. Of these, 62.6% of accounts have been found to have the same password repeatedly used.

Nepal Bank Limited

138 details of Nepal Bank Limited have been leaked. Which are related to 56 different email accounts. An email related to Koshi Province once, an email related to Talchowk branch once, an email related to Karnali Province twice and an email related to Tikapur branch twice have been leaked. Similarly, an email related to mobile banking once and an email account related to demat have been found twice. Accounts with usernames fieun, sdr, which do not have a specific meaning, have also been leaked twice.

In this way, 29.7% of the leaked details were found to be weak, while only 2.9% of the passwords were of strong and secure standards. In addition, it seems that the same password was used repeatedly in 46.4% of the accounts.

Agricultural Development Bank

119 password details of 20 different email accounts of Agricultural Development Bank have been leaked. Emails of branches like Biratnagar, Chautara, Janakpur

Accounts have been leaked repeatedly. Audit-related emails have been leaked 6 times and treasury-related emails have been leaked 18 times. An employee with the surname Adhikari has been found to have been leaked 34 times.

Out of the leaked passwords, 10.1% were found to be weak and 13.4% were found to be strong. It appears that the same password was used repeatedly in 66.4% of the leaked accounts.

Kumari Bank

107 password details of 43 different email accounts of Kumari Bank have been leaked. An email related to the admin of this bank has been leaked twice. Similarly, an account given the username kbrf has been leaked once. The others are employee-related email accounts. An employee with the surname Subedi of this bank has been found to have been leaked 23 times.

Out of the leaked passwords, 16.8% were found to be weak and 30.8% were found to be strong. It appears that the same password was used repeatedly in 60.7% of the leaked accounts.

NMB Bank

111 password details of 50 different email accounts of NMB Bank have been leaked. The email of Biratnagar branch has been leaked once and the info email twice. The email of an employee of this bank has been leaked 16 times. The rest are all employee email accounts. Whose username and password are on the darkweb.

Out of these, 36.4% passwords were found to be weak, while only 14.5% passwords are strong. Also, the same password was found to be used repeatedly in 30% of accounts.

Prabhu Bank

56 password details of 31 different email accounts of Prabhu Bank have been leaked. This bank's account email has been leaked once, admin authentication email once, info 1 packet, Prabhu Bank username email once and registered email twice. The email of an employee of this bank with the surname Sapkota has been leaked up to 5 times. The remaining accounts are related to employees.

Of the leaked passwords, 38.6% are weak and 13.6% are strong. In addition, the same password was used repeatedly in 52.3% of the accounts.

Citizens Bank International

56 password details of 31 different email accounts of Citizens Bank International have been leaked. Email accounts of Nepalgunj and Barahi branches have been leaked once each. Similarly, the account of the system guest user has been leaked once. The remaining accounts are in the names of employees.

37.5% of the passwords are weak and 21.4% are strong. In addition, the same password is used repeatedly in 41.1% of the accounts.

Standard Chartered Bank Nepal

A different situation has been observed in the case of Standard Chartered Bank. It is an international bank. It does not have a separate domain name for Nepal. In the case of Nepal, this bank has created a category page. Therefore, it is not possible to say whether the leaked details belong to a bank in Nepal or not. 20 accounts of this bank have been found on the dark web. All of them are separate accounts.

Of these, 52.6% passwords are weak and 21.1% passwords are strong. In addition, the same password has been used repeatedly in 26.3% of the accounts.

Himalayan Bank

68 password details from 44 different email accounts of Himalayan Bank have been leaked. An email related to audit has been leaked twice, an email related to CSD once, an email related to the call center once, an email account with the Himal username once and an email of the Bhaktapur branch once. The emails of seven employees of this bank have been leaked three times each.

Of these, 44.1% passwords are weak, while not a single password (0%) that meets the strong criteria was found. In addition, the same password has been used repeatedly in 11.8% of the accounts.

NIC Asia Bank

60 password details of 30 different email accounts of NIC Asia Bank have been leaked. Apple ID has been leaked once. The bank's IT-related account has been leaked twice. Similarly, the helpdesk email has been leaked five times. The email account provided by this bank with the username Voe has been leaked three times.

Of these, 15.9% passwords are weak and 17.4% passwords are of strong standards. Also, 46.4% of the accounts have been found to be using the same password repeatedly.

Prime Commercial Bank

An email account of Prime Commercial Bank has been leaked twice. The leaked account is related to the admin. Although the email accounts of other employees of this bank are not found on the dark web, the leaked account is very sensitive.

Although the password used in it is of a strong type, it seems to have been leaked through malware.

Global IME Bank

An email account of an employee of Global IME Bank has been leaked twice. No other system admin or IT related emails have been found for this bank. The password used in it is of medium level. This account appears to have reached the dark web through Infostealer malware.

Nepal Investment Mega Bank

A password detail of an email account of Nepal Investment Mega Bank has been leaked. An email of an employee with the surname Kharel has been leaked. Although the password is of a strong type, it appears to have reached the dark web through Infostealer malware.

Laxmi Sunrise Bank

A password detail of an email account of Laxmi Sunrise Bank has been leaked. This password is also very weak.

Our study and its limitations

For the purpose of this research, Tekpana has collected data published on various dark web platforms, leak platforms and paste sites from 2019 to June 2026. During this process, technical collaboration was established with the American technology company Visual AI Inc. As mentioned above,

The data recorded is only from bank employees, system administration and various departments. We will analyze the leaked details of these bank customers in more detail in the upcoming series.