The bomb threat emails sent to schools in Ahmedabad and across Delhi, Punjab, Haryana, Maharashtra, Assam and Uttar Pradesh were part of an orchestrated foreign operation, city police have confirmed.
A group based abroad ran the campaign through Saurav Biswas, a Bangladeshi national originally named Michael Biswas. Investigators are calling it "panic terrorism."
JCP Sharad Singhal said, "Biswas had sold this data to a person in Bangladesh who was in contact with the group orchestrating the threats."
Biswas had been tasked with sending threat emails to schools across the country. Several messages mentioned Khalistan and named prominent politicians. "We have started coordinating with central agencies and also the Ministry of External Affairs after identifying digital footprints of the key conspirator who is based overseas," a senior police official confirmed.
A dark web shop
Biswas ran a website on the dark web-a digital bazaar that sold identities and access tools. The inventory tells the story. Cash App accounts, bank accounts, Gmail IDs, Google Voice numbers, TextNow accounts, IP and proxy services, VPN services, premium subscriptions, Tellabot accounts, Facebook and Instagram profiles, WhatsApp and Telegram accounts, valid phone numbers and RDP or VPS services; one to five dollars per item; payment in cryptocurrency.
Police recovered nearly 200 Gmail IDs from his computer system, along with passwords and data tied to recovery email accounts. They also found Hotmail IDs allegedly used to send threat mails.
Same tactic used in 2023
In 2023, coordinated bomb threat emails struck schools across Lithuania, Latvia and Estonia during the Russia-Ukraine conflict. Lithuanian authorities called it a mass attack. Hundreds of schools received threatening emails containing political messages. In Estonia, bomb threat spam shut down most schools in Tartu.
Nearly 300 schools in Latvia were hit. Police later classified most threats as low-risk, but evacuations had disrupted thousands of lives. The tactic works because it costs almost nothing. Digital tools and networks let attackers generate hundreds of threatening messages for a few dollars. The growing availability of large language models has made it easier still, producing convincing threats in multiple languages at speed. Even when the threats are hoaxes, they force evacuations, shut down schools and stretch police thin. The objective, investigators believe, is simple. Seed fear. Disrupt public life. Paralyse institutions.