Indian police probe bomb-hoax email network and plan to question Google over 500,000 accounts

The case began with a September 10 bomb-threat email sent to the Gujarat state government. Police said it named state offices, senior Indian officials and countries cooperating at the BRICS summit. Searches found no bomb and the threat was judged a hoax.

Police arrested two people in Bihar and Jharkhand and said they recovered 513,847 unique email IDs and passwords. A senior Gujarat cybercrime officer told Reuters the accounts had been managed and supplied since 2022. Other reporting says technical analysis continues and investigators have not established how many accounts were actually used for threats or other crimes.

The officer told Reuters that police intend to make Google a formal subject of the investigation and ask how so many accounts passed two-factor authentication and what safeguards are needed. Google did not immediately respond, and police announced no charge or penalty against the company; platform wrongdoing or a specific vulnerability is therefore not established.

Police are also examining alleged links to a buyer in Bangladesh and cryptocurrency payments. Those cross-border and financial claims remain investigative leads. People who have not been charged, including account holders, should not be treated as criminals without court records or further independent evidence.