Gujarat Police have uncovered a vast cybercrime network involving more than 500,000 fake Gmail accounts allegedly used to send hoax bomb threats to government offices. According to reports from Reuters, investigators found a database containing 513,847 Gmail usernames and passwords, with the accounts allegedly having been in use since 2022. The discovery raises significant questions about Google's security safeguards and their effectiveness in preventing such large-scale fraudulent account networks. The investigation began after a bomb threat email was received by the state government on September 10, days ahead of the recent New Delhi summit of the BRICS grouping. "The scale of fake Gmail accounts in use is unprecedented," said senior cybercrime official Vivek Bheda to Reuters, highlighting the unprecedented nature of this cybersecurity breach. As reported by Reuters, India is one of Google's largest markets by users, making this security breach particularly significant for the technology giant.
Two people have been arrested in connection with the investigation, as reported by senior cybercrime official Vivek Bheda to Reuters. The case came to light after Gujarat authorities received an email warning of a bomb attack on September 10, days before leaders gathered in New Delhi for the BRICS summit. The threat extended beyond India, targeting countries cooperating with the government during the high-profile meeting, with investigators later finding that the warning was a hoax. One of those arrested was in contact with a buyer in Bangladesh who purchased batches of the accounts and paid at least partly in cryptocurrency to send the fake emails. The Gujarat investigation began after a bomb threat email received by the state government on September 10, days ahead of the recent New Delhi summit of the BRICS grouping.
Investigators believe the network supplied batches of Gmail accounts to customers, including the buyer in Bangladesh who used the accounts to send fake bomb threats and paid at least partly in cryptocurrency, according to Reuters. A key concern for investigators is that the fraudulent Gmail accounts had two-factor authentication enabled, raising questions about how the network was able to create and manage such a large number of accounts despite Google's additional security checks. The criminal network managed to bypass Google's two-factor authentication system for 513,847 accounts, representing a significant security breach. "How the criminal network managed to do this for such a large number of accounts is another angle of investigation," Bheda told Reuters, indicating the complexity of the security breach. Police are now examining how the network was able to create and manage hundreds of thousands of accounts while apparently bypassing or exploiting existing safeguards.
The police probe will examine how the accounts were generated, whether Google's existing safeguards were circumvented and whether changes to its policies are required, as stated by senior cybercrime official Vivek Bheda to Reuters. "We will write to Google, ask them to make some policy changes so (safeguards) cannot be bypassed," Mr. Bheda said, adding that police planned to formally designate Google as a subject of the investigation soon. Google, owned by Alphabet Inc, did not immediately respond to a request for comment, and it was not immediately clear what legal charges or penalties, if any, Google could face. The investigation highlights cybersecurity concerns as burgeoning cybercrime causes losses running into more than $2 billion a year from financial scams in India. As reported by Reuters, India's growing cybercrime problem has led to increased scrutiny of technology platforms that criminals allegedly exploit to facilitate such crimes.
The Gujarat case adds to existing concerns about Google's security measures in India, as authorities have identified a pattern of criminals misusing Google's Firebase web development platform in financial scams. India's law enforcement agencies have increasingly investigated technology platforms that are allegedly exploited in cybercrime, as financial scams cause losses of more than $2 billion a year in the country. The Gujarat case specifically adds scrutiny of account-creation and authentication controls to existing concerns around the misuse of online services. The investigation will now examine how the criminal network obtained and managed hundreds of thousands of accounts, as well as how its safeguards were bypassed, adding to the growing pressure on Google to strengthen its security measures in the Indian market.
