Ahmedabad Bomb Threat Emails Traced to Bangladesh and Pakistan, Cyber Crime Probe Finds

Two Separate Bomb Threat Cases Under Investigation

The Cyber Crime Branch is investigating two separate incidents involving threatening emails sent to locations across Ahmedabad.

The first case was registered on October 7 after emails were sent to 16 locations. The targets reportedly included 10 schools, the Gujarat High Court, other court premises, the Mayor’s Office and the Narendra Modi Stadium.

A second case was registered on October 27 after another threatening email named 19 locations, including 14 schools, government offices, courts and the Narendra Modi Stadium.

Taken together, the two incidents involved threats against 35 locations, according to reports citing the Cyber Crime Branch.

Cyber Crime Probe Points to Bangladesh and Pakistan

Investigators examined email headers and information obtained from Gmail as part of their effort to establish how the threatening messages were sent.

Preliminary findings reportedly indicated that accounts connected to the first incident were operated from Bangladesh and Rawalpindi in Pakistan.

In the second incident, the digital trail reportedly pointed to Rangpur in Bangladesh and Lahore in Pakistan.

Authorities are now examining whether the same wider network was involved in both incidents and how the compromised accounts were obtained and subsequently used.

Hacked Gmail Accounts Under Investigation

One of the significant findings in the investigation is the suspected use of previously compromised Gmail accounts.

According to reports citing the Cyber Crime Branch, an earlier investigation into similar threatening emails resulted in the arrest of a person in West Bengal. Police reportedly found that hacked Gmail accounts had been sold to a person in Bangladesh and subsequently transferred to a person in Pakistan, with cryptocurrency allegedly used in the transaction.

Investigators are examining whether a similar account-trading mechanism was involved in the latest Ahmedabad cases.

The development highlights how compromised online accounts can potentially be misused to conceal the identity and location of people sending malicious communications.

Why the Narendra Modi Stadium Was Mentioned

The Narendra Modi Stadium in Ahmedabad was among the locations mentioned in the threatening emails.

The messages also reportedly referred to upcoming events involving singer and actor Diljit Dosanjh, including a scheduled performance at the stadium on November 21.

The references to a major public venue and schools increased the seriousness of the investigation and prompted authorities to examine the affected locations and collect technical evidence.

Schools and Courts Among the Targets

The threatening messages did not focus on a single type of location. Schools, court complexes, municipal offices and the cricket stadium were among the places named.

In the October 27 incident, 14 schools were reportedly among the 19 locations mentioned in the email. Courts and government-related offices were also included.

Following the threats, investigators collected email-related evidence from affected institutions as part of the technical examination.

Role of Email Headers in the Investigation

Email headers can contain technical information that investigators may use to understand how an email travelled through internet services and identify associated account activity.

In this case, the Cyber Crime Branch reportedly examined email headers along with information obtained from Gmail. The findings helped investigators identify account activity associated with locations in Bangladesh and Pakistan.

However, identifying the apparent operating location of an online account does not by itself establish the physical identity of the person who created or sent a threatening message. Investigators must establish the complete chain of evidence before assigning responsibility.

Cyber Crime Branch Working With Central Agencies

The Ahmedabad Cyber Crime Branch is continuing its investigation in coordination with central agencies.

Investigators are expected to examine the origin of the compromised accounts, the people involved in transferring or selling them, the communications surrounding the threats and any financial transactions connected with the suspected account network.

The investigation could also help authorities understand whether the Ahmedabad incidents are connected to other similar online threats reported in India.

Threats Remain a Matter of Investigation

Although the emails generated serious concern because they targeted public institutions and a major sports venue, the investigation described the incidents as hoax bomb threat cases.

Authorities are continuing to verify the information contained in the emails and identify those responsible for sending them.

It is important to distinguish between an email’s technical origin, the location associated with an online account and the identity of the individual ultimately responsible for sending a threat.

What This Case Says About Cybersecurity

The Ahmedabad investigation also demonstrates the security risks associated with compromised email accounts.

Cybercriminals can potentially misuse stolen or compromised accounts to send fraudulent messages while attempting to make attribution more difficult. Organisations should therefore use strong passwords, multi-factor authentication, security monitoring and timely account-recovery procedures.

Users should also avoid reusing passwords across multiple services and should immediately investigate suspicious login notifications or unexpected account activity.

Investigation Continues

The Ahmedabad Cyber Crime Branch is continuing to investigate the two bomb threat cases. Authorities are working to establish the complete digital trail and identify the individuals responsible.

The alleged Bangladesh and Pakistan connections remain part of the preliminary investigation, and further evidence may clarify the structure and extent of the suspected network.

For now, the case remains an active cybercrime investigation involving compromised email accounts, threatening communications and multiple public locations across Ahmedabad.

Key Takeaways

• Ahmedabad Cyber Crime Branch is investigating two separate bomb threat email cases.
• The October 7 incident reportedly targeted 16 locations.
• The October 27 incident reportedly targeted 19 locations.
• Across the two incidents, 35 locations were named.
• Schools, courts, government offices and Narendra Modi Stadium were among the reported targets.
• Preliminary digital evidence reportedly pointed to account activity associated with Bangladesh and Pakistan.
• Investigators are examining the suspected use and sale of compromised Gmail accounts.
• The investigation is continuing in coordination with central agencies.

Frequently Asked Questions

How many locations were targeted in the latest Ahmedabad bomb threat?

The October 27 email reportedly named 19 locations, including 14 schools, government offices, courts and the Narendra Modi Stadium.

How many locations were involved in both incidents?

The two reported incidents involved a total of 35 locations: 16 in the October 7 case and 19 in the October 27 case.

Where were the email accounts reportedly operated from?

Preliminary findings reportedly associated the accounts with locations in Bangladesh and Pakistan, including Rangpur and Lahore in the second case.

Were hacked Gmail accounts involved?

Investigators are examining the suspected use of compromised Gmail accounts. A related earlier investigation reportedly uncovered the sale and transfer of hacked Gmail accounts.

Is the investigation complete?

No. The investigation is ongoing, and the reported international links and identities of those responsible remain subject to further verification.