A hacker group calling itself "Scarlettgroup" claims it breached the official Rajasthan Police website and is selling the stolen data on BreachForums. According to India Today, the group says it holds about 70,000 identity records, 59,460 mobile numbers, internal emails and 6.63 GB of attachments, including FIRs, eKYC documents and witness statements. The breach is not confirmed. Every figure in circulation comes from the attacker's own forum post, first flagged by the threat-monitoring account FalconFeedsio on X. As of publication, Rajasthan Police had not commented, and India Today said it "cannot independently confirm the authenticity of the breach." No PRIMARY-tier source (victim statement, regulator filing or CERT-In advisory) exists yet. Treat everything below as an unverified claim.
What Happened
India Today reported on 21 October 2026 that FalconFeedsio first surfaced the claim on X. Scarlettgroup's BreachForums post said: "We have breached Rajasthan Police, and its data is now available for purchase."
The incident has been framed two ways. India Today's headline calls it a breach of a "Rajasthan govt website," but the article body and the actor's post name the Rajasthan Police website specifically. This brief treats the Police site as the claimed target.
The context gives the claim some plausibility, though none of it confirms the breach:
- 14 to 15 October 2026: the Rajasthan Police cyber wing (R4C), acting on the directions of DGP Rajeev Kumar Sharma, issued an advisory on official email security. IANS (via The Hawk), NewKerala and UdaipurTimes all reported it. ADG (Cyber Crime) V.K. Singh said the Security Operations Centre had found government email login credentials "leaked and offered for sale on the dark web."
- 1 October 2026: Bharat Live 21 reported that Chief Secretary V. Srinivas ordered security audits, data verification and regular updates for major state portals, including DBT, Jan Aadhaar, pensions and PM-Kisan. He also directed coordination with NCIIPC and a cyber-security workshop in October.
So the state government was already worried about dark-web credential leaks the week before Scarlettgroup's post. No source links the advisory to this claim, and we don't either.
What Was Taken
Everything in this section is claimed by Scarlettgroup and reported by India Today. None of it has been verified.
- About 70,000 identity records. India Today's headline says "up to 70,000."
- 59,460 mobile numbers. India Today's summary rounds this to 59,000.
- "Millions of emails." This phrase appears in India Today's own summary paragraph, not in the group's quoted claim. The volume is especially uncertain.
- Email from senior officers. The group says it has emails belonging to the "director, inspector general" and others.
- 6.63 GB of attachments. These reportedly include eKYC documents, FIRs, investigation bundles, witness statements, pay slips, identity cards, bank statements, scanned reports and circulars.
If the claim is real, the sensitivity is severe. Witness statements and investigation files could put witnesses at risk and damage active cases. eKYC documents and bank statements on officers and citizens are ready-made material for identity fraud. Internal circulars and officer mailboxes help with targeted phishing against other parts of the government. India Today notes that "the authenticity, attribution and full extent of the claimed breach remain unverified." No sample validation by an independent researcher has been reported.
Why It Matters
- Law-enforcement data is a high-value target. FIRs and witness material are useful to criminals, extortionists and foreign intelligence services alike.
- Credential reuse is a known weakness in this environment. The R4C advisory says official email IDs also give access to Rajasthan SSO, SecLAN and RajSWAN. It also says staff register those IDs on Amazon, Flipkart, Zomato, Facebook, cab apps and gaming apps, often with the same password. If any of those credentials were used here, one leaked mailbox could open access across the state network.
- Indian state systems are under steady pressure. Sachchai Ki Jeet reported an unrelated intrusion attempt on a state health authority server on 21 August 2026, investigated by that state's ITDA. The attacker brute-forced accounts until two locked, logged in, ran Advanced IP Scanner and tried to dump registry credential hives before endpoint security stopped them. It is a different state and a different incident, but it shows the kind of credential-led tradecraft government networks face.
- Be careful with attribution. The Dotsquares piece on an older incident is a useful reminder. Several Indian ministry websites went down, and "Chinese hackers" were widely blamed after Mandarin characters appeared on the pages. NIC and the IT minister later attributed the outage to hardware failure, and the characters turned out to be a Drupal theme logo. Breach claims on forums are often inflated, recycled or invented to boost the seller's reputation.
The other sources add nothing substantive. The DOIT&C privacy-policy page contains only IT-sector definitions and does not address the incident.
The Attack Technique
Unknown. Scarlettgroup has not said how it got in, and no investigating authority has commented. The claimed data mix (officer mailboxes plus large document stores) fits either of two routes:
- compromised webmail or SSO credentials, the risk R4C warned about a week earlier, or
- a web application flaw in the Police portal that exposed its back-end document storage.
Neither has been confirmed. Until Rajasthan Police, CERT-In or an independent analysis of the leaked samples says more, any statement about initial access is speculation.
What Organizations Should Do
- Rotate credentials and enforce MFA now. Assume official mailboxes linked to SSO, SecLAN and RajSWAN may be exposed. Force password resets for police and linked-department accounts, and require phishing-resistant MFA for webmail and SSO.
- Hunt for credential reuse. Check official email addresses against breach corpora and dark-web monitoring feeds. Follow R4C's advice to remove government IDs from shopping, social media and gaming services.
- Review mailbox and portal logs. Look for the warning signs R4C listed: unrequested OTPs, sent mail the user didn't write, unread mail marked as read, and unexpected logouts. Also look for large exports from document stores or bulk attachment downloads.
- Validate the claim quickly and say what you find. Obtain and analyse any samples Scarlettgroup posted, then issue a clear public statement. Silence lets the attacker's figures become the official record.
- Protect the people in the data. If witness statements or eKYC files are confirmed exposed, notify affected witnesses and officers, raise fraud alerts with banks, and assess safety risks in sensitive cases.
- Harden public-facing portals. Continue the Chief Secretary's audit programme, with NCIIPC involvement, for internet-facing police and citizen-service applications. Prioritise any portal that stores scanned documents.
Sources: Rajasthan govt website data breach reported, up to 70,000 identity... | DBT-पेंशन से किसान सम्मान निधि तक अलर्ट! CS ने बनाया साइबर सुरक्षा... | Rajasthan Police Advisory on Govt Email ID Security | Privacy Policy - DOIT&C - Rajasthan Gov | Rajasthan Police Warn Officials Over Email ID Security | प्रदेश स्वास्थ्य प्राधिकरण के सर्वर में सेंध की कोशिश, पासवर्ड हैक... | INDIAN GOVERNMENT WEBSITES SUFFERED DOWNTIME LAST FRIDAY AND SPECUL... | Strengthen security of official email IDs: Rajasthan Police to govt...