Short answer
A group calling itself ScarlettGroup claimed on 21 October 2026 that it had breached Rajasthan Police and put the data up for sale. A senior cybercrime officer has said the state received information that the group obtained data from several government departments, and personnel were told to change email passwords. The size and authenticity of the data have not been confirmed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Rajasthan Police |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Government and law enforcement |
| Country | India |
| Detected | 2026-10-21 |
| Disclosed | 2026-10-21 |
| People or records affected | Unknown. The group claims about 70,000 identity records and 59,460 mobile numbers. Unverified. |
What data was exposed
- About 70,000 identity records (claimed)
- 59,460 mobile numbers (claimed)
- Official emails, including those of senior officers (claimed)
- FIRs, eKYC documents and witness statements (claimed)
- About 6.63 GB of attachments such as pay slips, ID cards and bank statements (claimed)
What was claimed
On 21 October 2026, the cybersecurity account FalconFeedsio flagged a post by a group calling itself ScarlettGroup. The group said on the dark web forum BreachForums: “We have breached Rajasthan Police, and its data is now available for purchase.” Business Today reported the claimed haul as about 70,000 identity records, 59,460 mobile numbers, emails from senior officers, FIRs, eKYC documents and witness statements, plus around 6.63 GB of attachments.
The group shared redacted sample images and said it would give unredacted files to buyers. It gave no price and said it would sell to several buyers. Business Today said it could not independently verify the claim and said the authenticity, attribution and full extent of the claim remain unclear.
The police response
Rajasthan Police had not commented when the first reports appeared. By 30 October, ThePrint reported that Cyber Crime DIG Shantanu Kumar said the state had received information that the group had obtained data from several government departments, and that personnel were told to change email passwords. The department has not published a count of affected people.
Why this matters to ordinary people
An FIR contains names, addresses, phone numbers and the story of a complaint. Anyone who has reported a theft, an accident or a family dispute could be exposed in such a file. The risk is a caller who knows enough to sound like an officer. Our guide to government impersonation scams explains how those calls work, and urgent payment scams covers the pressure tactics. If you think your details were involved, follow our data breach checklist.
What is still unknown
Whether the data is real, how it was taken, and how many people it covers. The same group is also linked to the claim against AU Small Finance Bank. Track other incidents on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake police or court calls that quote real case details, witness names or FIR numbers to pressure people into paying.
- Digital arrest scams, where a caller on video claims to be from the police or CBI and demands money to 'close' a case.
- Phishing emails that appear to come from Rajasthan Police or government offices, built from real email threads.
- Extortion of complainants or witnesses whose names appear in leaked FIRs.
What to do if you are affected
- 01Police never ask for money over a call or video call to settle a case. Hang up on anyone who demands payment or tells you to stay on a video call.
- 02If you filed an FIR or gave a statement to Rajasthan Police, be wary of calls that mention it. Confirm by visiting the police station or using the official Rajasthan Police website.
- 03Do not open attachments or links in emails that claim to be from police, courts or government departments without checking the sender address.
- 04Government and police staff should change official email passwords, turn on two-step verification and update their devices, as the department has instructed.
- 05If you are targeted, call 1930 and report at cybercrime.gov.in. Report suspicious phone numbers on the Chakshu facility at sancharsaathi.gov.in.
Frequently asked questions
Did Rajasthan Police confirm the data breach?
Not fully. Cyber Crime DIG Shantanu Kumar said, as reported by ThePrint, that the state had received information that the group obtained data from several government departments. The scope has not been confirmed.
What data is ScarlettGroup selling?
The group says it holds about 70,000 identity records, 59,460 mobile numbers, official emails, FIRs, eKYC documents, witness statements and about 6.63 GB of attachments. These are claims, and Business Today said it could not independently verify them.
Am I affected if I filed a police complaint in Rajasthan?
That is not known. If your FIR or statement is in the claimed data, expect calls that mention your case. Verify through the police station, not through a number the caller gives you.
Is it a genuine police call or a scam?
Police do not demand money by phone or keep people on video calls. A call that threatens arrest and asks for payment is a scam, even if the caller knows real details about you.
Where can I report cyber fraud in India?
Call the cybercrime helpline 1930 and file a complaint at cybercrime.gov.in. Calling quickly improves the chance that a fraudulent transfer can be frozen.
Sources
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.