Rajasthan Police Faces Massive Data Breach Claim

A hacker group identifying itself as ScarlettGroup has claimed unauthorised access to Rajasthan Police databases, allegedly obtaining 86.3 lakh emails and sensitive government records. The incident has triggered an investigation, raising serious concerns about cybersecurity across India's public institutions.

According to media reports, the group claims possession of 5,926 mailboxes, more than 78.3 lakh unique email addresses, 70,301 identity records and 59,460 mobile numbers. However, these figures remain unverified.

The alleged stolen information includes First Information Reports (FIRs), call detail records, electronic Know Your Customer documents, witness statements and confidential communications involving senior police officials.

More alarmingly, ScarlettGroup claims access to Rajasthan's Department of Information Technology and Communication records, including 1,065 mailboxes, 69 login credentials, 21 VPN logins and 64 VPN certificates.

If authenticated, such information could facilitate identity theft, targeted phishing, official impersonation and unauthorised network access. Exposure of witness identities and investigation documents could also threaten public safety and compromise ongoing criminal investigations.

Rajasthan Police Cyber Crime DIG Shantanu Kumar confirmed that specialised cyber teams were examining the allegations. The investigation involves the state's Cyber Security Operations Centre, with CERT-In and the Indian Cyber Crime Coordination Centre assisting.

Authorities have instructed police personnel to change official email passwords, update laptops and mobile devices, and strengthen cybersecurity practices. Investigators are examining whether government systems were compromised or documents originated elsewhere.

The incident highlights growing vulnerabilities in interconnected government infrastructure, where compromised credentials, weak access controls and inadequate monitoring can potentially expose extensive confidential information.

Cybersecurity specialists emphasise the importance of zero-trust architecture, multifactor authentication, privileged-access management, encryption, continuous threat monitoring and independent forensic audits to protect sensitive public-sector databases.

The bigger warning is that digital governance requires continuous verification, not assumed trust. Until forensic findings establish the breach's authenticity and scale, the allegations remain unconfirmed. Nevertheless, the case reinforces the urgency of strengthening India's government cybersecurity resilience.