Gujarat police find 513,847 Gmail logins behind hoax bomb emails and will question Google

Gujarat’s cybercrime unit says it has seized credentials for 513,847 Gmail accounts used since 2022 to send hoax bomb threats, and that it will write to Google to demand changes in how those accounts can be created and locked. Vivek Bheda, a senior officer in the state police cyber wing, told Reuters on Tuesday that investigators intend to name the company as a subject of the inquiry. Alphabet has not issued a public reply.

The case opened after a bomb-threat email reached Gujarat government offices on 10 September, days before BRICS leaders met in New Delhi. A second message, twelve minutes later, targeted the Department of Legislative and Parliamentary Affairs and named the Assembly, the Chief Minister’s Office, national leaders and countries that backed India at the summit. The threats were sent from addresses including mortonrenisch73@gmail.com and jondmoragn52627@gmail.com. Police say they were false. Buildings were still cleared. The timing sat on top of a summit security plan.

Two men are in custody. Roshan Kumar Bhumihar was arrested in Bhagalpur, Bihar. A second suspect, identified in local reporting as Gulshan, was arrested in Deoghar, Jharkhand. Officers say the pair activated and used the accounts through virtual private networks and kept the logins in Google Sheets and Excel files. One of them, police allege, sold batches of accounts to a buyer in Bangladesh who paid at least part of the price in cryptocurrency and then sent the threat emails. Investigators say they have already traced more than 10,000 USDT across wallets and expect the total to rise.

Bheda called the scale of the stash unprecedented in his unit’s work. He also flagged a detail that will drive the letter to Mountain View: each fraudulent account, he said, had two-factor authentication switched on. That feature exists to stop strangers from walking into an inbox. Here it was used as a lock on inventory. The sellers could hand over a password and a second factor and still present the account as a finished product.

Police have described a possible misuse of Google developer tools, including Firebase, to industrialise sign-ups. That claim is so far an investigative lead, not a finding. What is on the record is the number of unique IDs, the two arrests, the Bangladesh buyer, the crypto payments, and the 10 September emails that kicked the case into a summit week.

India already books more than $2 billion a year in losses from cyber-enabled fraud, a figure Reuters repeated in its first report. Hoax bomb emails sit in a different column. They cost hours of evacuation, grounded flights and diverted police, even when the device never exists. Gujarat’s unit treats the 500,000-account pile as a factory for that kind of disruption, not as a single prank.

The legal path from here is ordinary and slow. Officers will send a notice to Google. They may list the company as a subject so they can ask for logs, signup metadata and recovery trails. Google can answer, stall, or contest the request in court. None of that returns the three hours a secretariat spent empty on 10 September.

For other state cyber cells the usable fact is the inventory method. A sheet with half a million rows, 2FA already set, priced in USDT, sold across a border, is a product line. If Gujarat can show how those rows were born inside Google’s own signup flow, the policy argument writes itself. If the accounts were phished or recycled from older breaches, the letter to Google becomes a smaller document.

Bheda’s public comments suggest he thinks the first story is closer to the truth. The next document that matters is the one his office said it will send.