Blog Details

A Gujarat bomb threat investigation has uncovered a large collection of email credentials allegedly linked to a wider cybercrime network. Gujarat Police have arrested two people during the probe and recovered a database containing 5,13,847 unique email IDs and passwords.

The investigation began after a threatening email was received by the Gujarat government’s Legislative and Parliamentary Affairs Department on September 10, 2026. Police are now examining the recovered email credentials and investigating whether the accounts were connected to other threatening messages or cybercrime activities.

How the Gujarat Bomb Threat Investigation Began

The Gujarat bomb threat investigation started after a threatening email was reportedly received by the Legislative and Parliamentary Affairs Department.

The message allegedly contained threats involving important government locations and public figures, including the Gujarat Chief Minister’s Office and the Gujarat Legislative Assembly. It also reportedly referred to Prime Minister Narendra Modi, Union Home Minister Amit Shah and countries associated with the BRICS summit.

Because of the seriousness of the communication, security agencies began examining the email and its digital trail.

The Gujarat Police Cyber Centre of Excellence played an important role in analysing the available technical information and identifying possible links to the people behind the communication.

Digital Investigation Led Police to Bihar and Jharkhand

As part of the investigation, police analysed the suspicious email and followed available digital leads to identify the people allegedly connected with the account.

The investigation reportedly led police to Bhagalpur in Bihar, where a man identified in reports as Roshan Kumar Bhumihar, also referred to as Rajendra Kumar Rai, was arrested.

During questioning, investigators allegedly learned that the email account used in the threatening communication had been obtained from another person based in Deoghar, Jharkhand.

Police subsequently arrested Gulshan Kumar Singh in Deoghar.

The investigation involved coordination between police teams from Gujarat, Bihar and Jharkhand, highlighting the increasingly interstate nature of cybercrime investigations in India.

Police Recover 5.13 Lakh Email IDs and Passwords

One of the most significant developments in the case was the recovery of a database containing 5,13,847 unique email addresses and corresponding passwords.

The discovery has substantially expanded the scope of the investigation.

According to reports, investigators suspect that the email accounts may have been created, collected or supplied for potential use in threatening communications and other cyber-related activities.

Police are now analysing the database to determine how the accounts were obtained, who controlled them and whether any of them were used in previous incidents.

Importantly, the recovery of the credentials does not by itself establish that all 5,13,847 accounts were used for criminal purposes. Investigators are still working to determine which accounts, if any, were actually connected with threatening messages or other offences.

Email Network Allegedly Active Since 2022

Investigators have reportedly alleged that one of the accused had been involved in creating and supplying email accounts and passwords since 2022.

Police are examining how the accounts were created and whether any methods were used to avoid normal account verification or authentication procedures.

The large number of recovered credentials has raised questions about the possible scale of the alleged network.

If multiple email identities were available to individuals involved in criminal activity, investigators may have to examine a large volume of digital records to establish connections between accounts, devices, communications and individuals.

Authorities are therefore continuing their technical analysis as part of the wider Gujarat bomb threat investigation.

Alleged Bangladesh Link Under Investigation

Investigators are also examining a possible cross-border connection.

According to police information reported by news organisations, some individuals associated with the suspected network may have links to people in Bangladesh.

Authorities are reportedly examining alleged financial transactions, communications and cryptocurrency-related activity that could help establish whether such a connection exists.

At present, the alleged Bangladesh connection remains under investigation. It is important to distinguish between an investigative lead and an established fact, as authorities have not yet completed their inquiry.

Why the Case Matters for Cybercrime Investigation

The Gujarat case demonstrates how digital communication platforms can potentially be misused to create fear and disrupt public institutions.

Threatening emails can be sent from accounts created under false or misleading identities, making the initial identification of the sender difficult.

When a large number of email accounts are involved, investigators may need to examine account information, communication records, device-related evidence and other legally obtained digital information to establish who controlled particular accounts.

The recovery of more than five lakh email credentials therefore gives investigators a substantial digital dataset to examine.

Among the key questions are:

• Who created or obtained the email accounts?

• Who had access to the credentials?

• Which accounts were actually used to send threatening emails?

• Were any of the accounts connected with earlier incidents?

• Were the credentials supplied or transferred to other individuals?

• Are there financial transactions associated with the alleged network?

• Are additional people involved?

• Are there connections between the email accounts and other digital evidence?

Answers to these questions could help investigators understand the structure and reach of the suspected network.

The Importance of Digital Evidence

The Gujarat bomb threat investigation also highlights the importance of digital evidence in modern criminal investigations.

A suspicious email can potentially provide investigators with useful leads regarding account activity, communication patterns and connections with other digital records.

However, an email address alone does not necessarily prove who was physically responsible for sending a message. Investigators generally need to establish the relationship between the account, the person controlling it and other relevant evidence.

In this case, police reportedly used technical analysis to trace the investigation across state borders, moving from Gujarat to Bihar and then to Jharkhand.

Such cases often require cooperation between different police units and careful examination of digital and financial evidence.

What Should People Do After Receiving a Threatening Email?

People who receive a suspicious or threatening email should take the communication seriously and report it to the appropriate authorities.

They should avoid responding to the sender or attempting to investigate the sender independently.

It is also advisable not to unnecessarily circulate threatening messages or screenshots on social media, as doing so can increase public panic and spread unverified information.

Suspicious cybercrime incidents can be reported to the appropriate law-enforcement authorities and, where applicable, through India’s official cybercrime reporting system. The 1930 Cyber Crime Helpline may also be used for relevant cybercrime emergencies and financial fraud situations.

Investigation Remains Ongoing

The arrest of two suspects does not mean that the investigation has concluded.

Police are continuing to analyse the recovered email credentials and determine whether the accounts were connected with other threatening communications or cybercrime incidents.

Investigators are also examining the alleged cross-border links, financial activity and possible involvement of additional individuals.

The large database of email credentials could provide investigators with further leads as they work to establish the full scope of the suspected network.

What the Gujarat Case Reveals About Modern Cybercrime

The case highlights the changing nature of cybercrime in India.

Digital threats do not always require physical access to a target. A person sitting in one location can potentially send a threatening communication to an institution in another state or even another country.

This creates significant challenges for law-enforcement agencies because cyber investigations can quickly cross geographical boundaries.

The recovery of 5,13,847 email IDs and passwords demonstrates the scale of the digital evidence being examined in the case. However, investigators still need to determine which credentials were actually used, who controlled the accounts and whether they were connected to criminal activity.

The Gujarat bomb threat investigation therefore remains an important example of how police agencies are using digital investigation and evidence analysis to trace suspicious online communications.

As the investigation continues, further details may emerge about the people involved, the purpose of the email network and whether the recovered credentials are connected with additional cases.

For now, authorities are continuing their investigation to identify the complete network allegedly associated with the bomb-threat emails and determine whether more individuals are involved.