India probes 513,847 fake Gmail accounts after bomb threats reached PMO and BRICS states

Indian police plan to question Google after investigators in Gujarat uncovered what they describe as a criminal network involving 513,847 Gmail accounts and login credentials, some of which were allegedly used to send hoax bomb threats to government offices and other high-profile targets. Two people have been arrested in connection with the investigation, while police are examining whether accounts were created or acquired at industrial scale and subsequently sold to other users, including buyers outside India. Google had not publicly commented on the specific allegations when Reuters reported the investigation on September 15.

The case attracted national-security attention after investigators linked the network to a bomb-threat email targeting the Prime Minister’s Office and entities associated with countries participating in the recent BRICS summit in New Delhi. Gujarat cybercrime investigators traced one of the messages to Bhagalpur in Bihar after working with central agencies, according to Indian Express reporting cited during the investigation. Authorities have not alleged that an actual explosive device existed in connection with the emails, making the case a cybercrime and hoax-threat investigation rather than evidence of a confirmed bombing plot.

What did Gujarat Police discover about the 513,847 Gmail accounts?

Investigators said they recovered login details associated with 513,847 Gmail accounts that had allegedly been accumulated since 2022. Reuters reported that police suspect some of the accounts were supplied to customers for illicit use, with transactions potentially involving cryptocurrency and buyers in Bangladesh. Authorities are now trying to determine who created the accounts, whether all of them were actively used and how many were linked to threatening messages or other forms of cybercrime.

The sheer number of credentials is what makes the case unusual. A criminal group controlling a small number of email addresses can send spam or isolated threats, but access to hundreds of thousands of accounts creates the potential for large-scale fraud, impersonation, phishing and repeated creation of apparently unrelated identities. Investigators are therefore examining the network as digital infrastructure rather than treating each threatening email as an independent offence.

Why are police interested in Google’s two-factor authentication systems?

Reuters reported that investigators were examining how accounts in the network could have been established while using Google’s two-factor authentication protections. Two-factor authentication is primarily designed to protect an existing account from unauthorised access, however, rather than to guarantee that every account was originally created by a unique legitimate individual. Police therefore need to distinguish between security features designed to prevent account takeover and safeguards intended to detect mass or abusive account creation.

Questioning Google does not mean Indian authorities have accused Alphabet Inc. or Google of participating in the alleged criminal activity. Investigators can seek technical records, account-creation information and other evidence from a platform provider when trying to reconstruct a network’s operations. The factual issue is whether available platform data can help explain how such a large inventory of credentials was assembled and whether automated or fraudulent verification methods were used.

How did the bomb-threat network become linked to the BRICS summit and Prime Minister’s Office?

One threatening email investigated by Gujarat Police reportedly targeted the Prime Minister’s Office and BRICS partner countries around the period of the New Delhi summit. Indian Express reported that cybercrime investigators traced that communication toward Bhagalpur after technical analysis and coordination with national agencies. Given the diplomatic sensitivity of the targets, security services treated the communication seriously even though the reported threat ultimately appeared to be a hoax.

That response illustrates the asymmetric economics of bomb-threat emails. Sending a hoax message can cost almost nothing, while governments may need to deploy police, bomb-disposal teams, cyber investigators and building-security personnel until the threat has been assessed. A network capable of repeatedly changing accounts and identities can therefore impose significant disruption without possessing any physical weapon.

Why have hoax bomb threats become such a major problem for Indian institutions?

India has experienced repeated waves of threatening emails directed at schools, airports, hospitals, government offices and other public facilities. Even when messages are ultimately determined to be false, security agencies cannot safely assume that conclusion when an alert is first received. Evacuations, flight disruption, search operations and emergency responses can follow before investigators establish credibility.

The challenge is compounded by global email platforms and anonymisation techniques that make attribution more difficult. Account details can be acquired from other people, created with false credentials or operated from one jurisdiction while targeting institutions in another. That gives cybercrime investigations an international dimension even when the immediate target is a school, ministry or company inside India.

Could hundreds of thousands of fake email accounts also be used for financial fraud?

Potentially, although authorities still need to establish how the individual accounts in this particular dataset were used. Large inventories of apparently legitimate email identities can support phishing campaigns, fake customer accounts, marketplace scams, social-engineering attacks and account-reset fraud. Reuters noted that cybercrime already causes more than $2 billion in annual losses in India, underscoring why authorities increasingly investigate the technological infrastructure supporting scams rather than focusing only on the final fraudulent transaction.

The economic damage can extend beyond money directly stolen from victims. Banks, technology platforms and businesses incur fraud-prevention costs, while repeated misuse of communications services forces companies to introduce verification processes that can also inconvenience legitimate users. Criminal account farms therefore create a broader cost for the digital economy even before an individual scam succeeds.

What could Indian investigators seek from Google as the inquiry expands?

Police could potentially seek account-registration information, security logs, recovery details and records associated with specific threatening messages, subject to applicable legal processes and the data that remain available. Investigators may also want to understand whether clusters of accounts shared common technical characteristics that should have triggered automated abuse detection. Google’s response will be important because the company operates one of the world’s largest email systems and possesses evidence that individual local police units cannot independently obtain.

Cross-border cooperation may become necessary if investigators substantiate claims that credentials were sold abroad. Cryptocurrency payments can also require separate blockchain and exchange-level analysis, depending on how transactions were structured. The inquiry could consequently expand into several parallel tracks involving account creation, financial flows, threatening communications and the identity of downstream users.

What are the key implications of India’s 500,000-account Gmail investigation?

The most important fact is not that 513,847 separate people sent bomb threats, because police have not established anything of that kind. Investigators instead say they discovered access credentials for more than half a million accounts within a network that included accounts allegedly used for threatening communications. Keeping that distinction clear prevents the scale of the credential database from being incorrectly converted into the number of criminal incidents.

The case nevertheless exposes how inexpensive digital infrastructure can magnify public-safety disruption. If investigators confirm that accounts were created, packaged and sold systematically, the network would represent an organised supply chain supporting online abuse rather than a single hoax sender. The next important developments will be Google’s cooperation, forensic analysis of the seized credentials and evidence establishing how many accounts were actually used for crimes.