Rajasthan Police is facing allegations of a cybersecurity breach after a hacker group identified as Scarlettgroup claimed to have stolen government data and offered it for sale online. A report published by NewsBytes on October 21, 2026, said the group claimed access to around 70,000 identity records, 59,460 mobile numbers and documents linked to First Information Reports (FIRs), electronic Know Your Customer (eKYC) records and witness statements. The alleged data package was said to total nearly 7GB.
The claims raise concerns about the potential exposure of sensitive personal information and law-enforcement records. However, the breach has not been independently verified, and Rajasthan Police had not publicly commented at the time of reporting. Cybersecurity trackers have separately recorded a Scarlettgroup listing associated with the Rajasthan Police website, but a threat actor’s claim or a listing on a leak site is not, by itself, proof that all the alleged data was stolen or is authentic.
Key Takeaways
- Alleged breach: Scarlettgroup claims to have compromised Rajasthan Police data and offered it for sale.
- Records claimed: The group reportedly claims access to around 70,000 identity records and 59,460 mobile numbers.
- Sensitive information: The alleged material includes FIR-related records, eKYC data, witness statements and official emails.
- Data volume: The group reportedly claims the attachments total nearly 7GB.
- Verification remains outstanding: The authenticity and full scope of the alleged exposure have not been independently established.
- Potential risks: If genuine, the data could increase the risk of identity fraud, targeted scams, impersonation and misuse of confidential information.
What Happened in the Alleged Rajasthan Police Data Breach?
According to NewsBytes, Scarlettgroup announced the alleged breach on BreachForums, an online platform associated with cybercrime-related disclosures. The group claimed it had breached Rajasthan Police and was offering the data for purchase.
The attackers reportedly shared redacted images of sample documents to support their claims, while stating that unredacted versions would be available to buyers. They also claimed to possess emails belonging to senior police officials, including the director general and inspector general of police.
These details remain allegations made by the group and reported by media outlets. Publicly available information does not establish how the attackers may have gained access, whether the material originated from Rajasthan Police systems, or whether the claimed records were actually extracted from a live government database.
What Data Was Allegedly Exposed?
The reported claims involve several categories of potentially sensitive information.
| Alleged data category | Reported details | Potential concern if verified |
|---|---|---|
| Identity records | Around 70,000 records claimed | Identity fraud and impersonation |
| Mobile numbers | 59,460 numbers claimed | Fraudulent calls, messages and phishing |
| FIR-related information | First Information Report records | Exposure of sensitive case information |
| eKYC records | Electronic identity-verification material | Misuse of personal identity details |
| Witness statements | Statements allegedly included in the dataset | Privacy and possible safety concerns |
| Official emails | Emails reportedly associated with senior police officials | Targeted phishing or impersonation |
| Data attachments | Nearly 7GB claimed | Potentially broad exposure, if authentic |
The figures are based on the reported claims, not a confirmed forensic assessment. They should not be interpreted as independently verified counts of unique individuals or records.
If genuine, exposure of police records could be more consequential than a typical contact-information leak. FIRs and witness statements can contain information about alleged crimes, complainants, witnesses and investigations. Unauthorized disclosure could compromise privacy and, in some circumstances, create risks for people involved in sensitive cases.
Who Is Scarlettgroup?
Scarlettgroup is the name associated with the alleged incident. Cybersecurity reporting indicates that the group has also listed other organizations on its leak site, although those claims should be evaluated individually.
The available reporting does not establish the group’s precise identity, its methods of gaining access, or whether it used ransomware, data theft alone or another form of extortion. A leak-site listing can be intended to pressure an organization into negotiations, attract buyers or build a criminal group’s reputation.
Consequently, it is important to distinguish between a group claiming an attack and investigators confirming the incident. Verification would require evidence such as forensic findings, validated samples, access logs and an official statement from the affected organization.
Why the Alleged Breach Matters
Risks to citizens
If personal identity information and mobile numbers were genuinely exposed, affected people could face more convincing phishing attempts, fraudulent calls or messages designed to obtain additional personal information.
Criminals sometimes use leaked details to make scams appear credible. A message that refers to a real name, phone number or case-related detail may persuade a recipient to reveal an OTP, click a malicious link or transfer money.
Risks to police investigations
Police records may contain information that is not intended for public release. If confidential case files or witness statements were exposed, investigators might need to assess whether people involved in ongoing cases face additional risks.
The extent of any such risk cannot be determined without knowing what the alleged dataset actually contains and whether it is authentic.
Risks to government systems
A confirmed compromise could prompt a review of the affected website, connected databases, staff accounts and third-party service providers. Investigators would need to establish whether the incident was limited to one system or involved wider access.
At present, there is no verified public evidence establishing the technical cause, the systems affected or whether police operations were disrupted.
What Should Happen Next?
The immediate priority is to establish whether the claims are genuine. Rajasthan Police and relevant cybersecurity teams would need to examine server and account logs, investigate unusual data transfers, preserve forensic evidence and assess whether credentials or connected systems were compromised.
If a breach is confirmed, appropriate measures could include disabling compromised access, rotating credentials, strengthening multi-factor authentication, reviewing access permissions and notifying affected people where warranted. Sensitive leaked material should be handled through authorized investigative channels rather than downloaded or redistributed.
Citizens should also be cautious about unexpected calls or messages claiming to be from police officials. They should avoid sharing OTPs, passwords or financial details and independently verify requests through official channels. The alleged incident is not proof that any particular citizen’s data has been exposed.
The Bigger Picture
The allegation highlights the sensitivity of government databases, particularly those maintained by law-enforcement agencies. Such systems may hold information about citizens, complaints, investigations and officials. A verified compromise could therefore have consequences extending beyond financial fraud to privacy, public trust and the protection of sensitive investigations.
The incident also illustrates why cybercrime claims require careful verification. Criminal groups can publish genuine stolen material, exaggerate the scale of an intrusion or make claims that have not been substantiated. Independent forensic evidence and transparent official communication are essential to determining what happened and what action is necessary.
FAQs
1. Was Rajasthan Police hacked?
A hacker group named Scarlettgroup has claimed responsibility for a breach. However, the allegation has not been independently verified, and the available reporting did not include an official confirmation from Rajasthan Police.
2. How many records were allegedly exposed?
Reports cite around 70,000 identity records and 59,460 mobile numbers. These are figures attributed to the alleged breach, not confirmed totals from an independent investigation.
3. What information did the hackers claim to have?
The group reportedly claimed to possess identity records, mobile numbers, FIR-related information, eKYC material, witness statements and emails associated with senior police officials.
4. Could citizens face financial fraud?
If the personal information is genuine and exposed, it could be used to support phishing, impersonation and fraudulent calls. Citizens should avoid sharing OTPs or passwords and verify unexpected requests independently.
5. Has the breach been officially confirmed?
The reporting available at the time of publication did not establish official confirmation or an independently verified assessment of the alleged data. The incident’s authenticity, technical cause and full scope remain uncertain.
Looking Ahead
The next important development will be confirmation from Rajasthan Police or an authorized cybersecurity investigation. A credible assessment should establish whether unauthorized access occurred, which systems and records were affected, how the intrusion happened and whether any information can be linked to identifiable individuals. Until that evidence emerges, the reported figures should be treated as claims rather than established facts.
If the breach is confirmed, the response will need to focus on containing access, protecting affected individuals, reviewing system security and preventing further disclosure. For the public, the practical response is to remain alert to impersonation attempts without assuming that personal information has necessarily been compromised. The incident’s true significance will depend on the evidence investigators uncover.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
