A cyberattack claim targeting the official Rajasthan Police website and its database has raised serious concerns regarding the integrity of sensitive law enforcement data. A threat group identifying itself as Scarlettgroup claims to have breached departmental systems, allegedly obtaining approximately 70,000 personal identity records, 59,460 mobile numbers, and an archive of investigative case material. The claim first surfaced on October 21 via a cybersecurity-focused account on social media, after which the collective published an offering on dark web marketplace BreachForums seeking commercial buyers for the stolen repository. While the purported exfiltration has generated alarm over potential identity theft and procedural compromise, authorities note that the breach claim remains unverified, with no independent forensic confirmation yet establishing that an unauthorized intrusion took place.
Alleged 6.63 Gigabyte Cache Contains FIRs and Witness Statements
According to listings posted by the hacker collective, the compromised files contain significant amounts of citizen and administrative information, including First Information Reports, electronic Know Your Customer records, and witness depositions. The threat actors assert that the core archive encompasses 6.63 gigabytes of attachment data, including departmental circulars, scanned investigative reports, salary slips, official identity cards, and bank statements. If verified, the unauthorized circulation of such material would threaten not only citizen privacy but also sensitive police operational protocols.
The group released redacted sample documents on the forum, asserting that complete, unredacted versions would be supplied to purchasers following private transactions. While Scarlettgroup has not publicly specified a fixed price, it indicated that the database is available to multiple buyers. Security analysts caution that should the files prove genuine, the presence of witness accounts and complainant identities within the dataset could create severe risks of targeted intimidation, digital extortion, and spear-phishing campaigns designed to deceive the public by using legitimate police details.
Absence of Official Confirmation as Forensic Verification Awaited
Rajasthan Police had not released a formal statement addressing the intrusion claims or confirmed whether internal technical teams had initiated a digital audit of their servers. Digital forensic specialists emphasize that promotional forum claims and sample screenshots do not automatically prove that an active intrusion occurred against departmental servers. Cybercriminals frequently re-package outdated, publicly aggregated, or third-party datasets under the guise of fresh breaches to inflate their credibility and attract buyers.
Determining the legitimacy of the claims will require comprehensive log analysis to identify potential entry points, assess traffic anomalies, and evaluate whether server repositories were directly compromised. Without formal confirmation from law enforcement authorities, the reported scope of compromised citizen records remains an unverified operational assertion rather than an established security failure.
Incident Follows Separate Cybersecurity Breach at State Bank of India
The emergence of the police breach allegation follows an acknowledged data security incident at the State Bank of India, where unauthorized activity affected the records of nearly 3,900 customers following a separate forum claim. Law enforcement officials have pointed out that no connection has been established between the two events, as they involve entirely distinct digital architectures, administrative frameworks, and threat actor profiles.
The concurrent emergence of these claims has intensified attention on cybersecurity standards across public sector agencies and financial institutions. Government repositories frequently maintain highly sensitive demographic records, legal filings, and financial details that demand continuous protective audits. For Rajasthan Police, establishing the technical reality behind Scarlettgroup’s claims will determine whether the incident reflects a major operational breach or an unsubstantiated commercial post on the dark web.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
