Jaipur: A hacker collective identifying itself as “ScarletGroup” has claimed to have exfiltrated large volumes of data from the Rajasthan Police and the state’s Department of Information Technology and Communication (DoIT&C), offering material for sale on darknet marketplaces and prompting a multi-agency cyber probe.
What the attackers allege
In a post that circulated on social media and darknet channels, the group said it accessed 5,926 mailboxes and 86.3 lakh emails, and listed more than 78.3 lakh unique email addresses. The claimed haul also included 70,301 identity records and 59,460 mobile numbers allegedly linked to personnel in the Rajasthan Police.
| Item | Number claimed |
|---|---|
| Mailboxes (Rajasthan Police) | 5,926 |
| Emails | 86.3 lakh |
| Unique email addresses | 78.3 lakh |
| Identity records | 70,301 |
| Mobile numbers | 59,460 |
The post also asserted possession of material from DoIT&C including 1,065 mailboxes, 69 login credentials, 21 VPN logins and 64 VPN certificates purportedly belonging to senior officials. Attackers circulated documents they said were copies of first information reports (FIRs), call detail records (CDRs), electronic Know Your Customer (e-KYC) files, witness statements and messages from official email accounts of senior police officers.
Official response and ongoing probe
State police said they had received information about the alleged compromise and mobilised cyber teams to examine the claims. Cyber Crime DIG Shantanu Kumar confirmed that multiple teams are scrutinising the material and coordinating with state and national agencies.
"We received input that the Scarlet Group had stolen important data from several departments, including Rajasthan Police. Our Cyber Commando Team and Incident Response Team have begun working on this. The Rajasthan Cyber Security Operations Centre of the state DoIT has also begun working," said Cyber Crime DIG Shantanu Kumar.
Officials emphasised that, at this stage, no concrete vulnerability has been identified in police systems and the authenticity and origin of the leaked material remain under investigation. The matter has been referred to the Indian Computer Emergency Response Team (CERT-In), with assistance from the Indian Cyber Crime Coordination Centre (I4C) to gather technical evidence.
Evidence shown and forensic steps
The files circulated by the group include screenshots and documents that the attackers claim are originals. Police and DoIT&C teams are conducting forensic analysis to establish whether the data is genuine, whether it was obtained from internal systems or compiled from other sources, and to determine the timeline and method of any compromise.
- Cyber Commando Team and Incident Response Team have been tasked with technical review.
- Rajasthan Cyber Security Operations Centre is involved in containment and assessment.
- Central agencies including CERT-In and I4C are assisting evidence collection and cross-jurisdictional inquiry.
Implications for policing and public confidence
If authenticated, the intrusion would represent a significant breach of sensitive law enforcement records and personal data of police personnel and citizens. Even unverified, the publication of alleged FIRs, CDRs and witness statements can compromise ongoing investigations, put witnesses at risk and erode public trust at a time when policing depends increasingly on digital communication.
Rajasthan’s police and IT administration face the immediate task of establishing whether accounts or servers were compromised, revoking any exposed credentials, and communicating next steps to affected personnel and departments. Cybersecurity experts typically recommend swift password resets, forced re-authentication for privileged accounts, network traffic analysis and, where necessary, isolation of affected systems — but officials have not publicly detailed measures taken so far.
The allegation comes amid a wider environment in which Indian public and private organisations have faced high-profile data breaches in recent years, raising concern about defensive readiness and the protection of citizen data. For now, Rajasthan authorities are focused on verification and technical containment while national cyber bodies collate evidence to support any subsequent investigation or remedial action.
Further updates are expected as forensic results arrive and agencies clarify whether the claims reflect a confirmed intrusion, partial exposure from disparate sources, or information aggregated from prior leaks. The investigation will determine legal, operational and disclosure decisions in the coming days.
