Archive · 16 Sep 2026
Gujarat Police Probe Google Over 500,000 Fake Gmail IDs
Police in Gujarat, India, found a very large collection of Gmail usernames and passwords.
The collection had 513,847 accounts.
Police arrested two people while investigating the network.
The investigation began after a false bomb threat was sent on September 10.
The threat came shortly before a BRICS summit in New Delhi.
Police say some accounts were used or intended for threatening messages, but they have not proved that every account sent bomb threats.
One suspect was allegedly connected to a buyer in Bangladesh who paid partly with cryptocurrency.
Police want Google to explain how so many accounts were created despite two-factor authentication.
Gujarat Police arrested two people and uncovered 513,847 Gmail IDs and passwords allegedly managed since 2022.
Investigators linked the network to false bomb threats against government offices and countries cooperating with India before the BRICS summit.
Police said the database may also have been intended for threats against schools, colleges and courts, but have not established that every account was used for bomb threats.
One arrested suspect allegedly dealt with a Bangladesh-based buyer who purchased account batches and paid partly in cryptocurrency.
Police plan to question Google about how the accounts bypassed safeguards, including two-factor authentication; Google has not immediately commented.
- Who
- Gujarat Police, senior cybercrime official Vivek Bheda, Google, and two arrested suspects are central to the investigation.
- What
- Police uncovered 513,847 Gmail IDs and passwords allegedly connected to a network used or intended for false threatening messages and bomb hoaxes.
- When
- The accounts were reportedly managed since 2022; the investigation began after an email sent on September 10, and two arrests were announced this week.
- Where
- The investigation is being conducted by Gujarat Police in India; the threatening email targeted the Gujarat government and countries cooperating with India around a BRICS summit in New Delhi.
- Why
- Police are investigating the criminal network and seeking answers from Google about how its safeguards, including two-factor authentication, may have been bypassed.
Police scrutiny
Company accountability and response
Safeguards and account creation
Police scrutiny
Gujarat Police want Google to explain how a network created and managed 513,847 accounts, including accounts reportedly protected by two-factor authentication, and plan to seek policy changes.
Company accountability and response
Google had not immediately commented, so its explanation for the account creation process and its safeguards was not available.
Google’s role in the investigation
Police scrutiny
Police plan to formally designate Google as a subject of the investigation because they believe safeguards may have been bypassed.
Company accountability and response
No legal charges or penalties against Google had been identified, and the company’s potential liability remained unclear.
Scope of the account network
Police scrutiny
Police linked the network to false bomb threats and believe the accounts may have been intended for other illegal activities targeting government offices, schools, colleges and courts.
Company accountability and response
Investigators had not established that every one of the 513,847 accounts was used to send bomb threats; the wider database was still being analyzed.
- Accounts uncovered
- 513,847 Gmail IDs and corresponding passwords
- Reported account activity
- The accounts were allegedly being managed or used since 2022
- Arrests
- Two people were arrested; reports said one was in Bihar and another in Jharkhand
- Investigation trigger
- A threatening email received by the Gujarat government on September 10
- Threat targets
- Government offices and countries cooperating with India around the BRICS summit; police also identified schools, colleges and courts as possible intended targets
- International link
- One suspect allegedly contacted a Bangladesh-based buyer who purchased batches of accounts and paid partly in cryptocurrency
- Google response
- Google did not immediately respond, and it was unclear whether it could face legal charges or penalties
