Ahmedabad’s cybercrime branch has said that a preliminary investigation into two sets of hoax bomb-threat emails targeting 35 locations identified access links involving Bangladesh and Pakistan. The findings remain part of an active police investigation and do not constitute a final judicial determination of the individuals responsible.
The first case was registered on 7 October after emails from two accounts threatened 16 locations, including ten schools, judicial facilities and the Narendra Modi Stadium. A second incident involved 19 locations, among them 14 schools, government offices, court complexes and the stadium. Security searches did not uncover explosive devices.
Police examined message headers, account-access information and other digital records associated with the Gmail accounts. Investigators said one set of access indicators pointed to Rangpur in Bangladesh, while other activity was linked to Rawalpindi and Lahore in Pakistan. The investigation has also focused on the resale of compromised or dormant email accounts through messaging platforms, including Telegram and WhatsApp, with cryptocurrency allegedly used for payment.
In an earlier connected investigation, a person was arrested in West Bengal for allegedly selling access to a Gmail account. Police said the account was subsequently transferred to a buyer in Bangladesh and then resold to a person in Pakistan. Investigators are examining whether the same account-resale chain was used in the Ahmedabad threats and whether additional intermediaries were involved.
The case illustrates how apparently routine account compromises can be repurposed for high-impact disruption. Older accounts may appear more credible to automated security controls, while the use of multiple resellers can make attribution more difficult. Message headers and access logs can identify infrastructure or account-access locations, but they do not automatically prove the physical location or identity of the person who composed a message.
Ahmedabad police are coordinating with central agencies as they seek subscriber records, platform information and cryptocurrency transaction trails. The investigation will need to distinguish between account sellers, intermediaries and the person or group that issued the threats. Until that process is complete, the Bangladesh and Pakistan connections should be described specifically as preliminary digital-investigation findings disclosed by police.
