Rajasthan Police may have suffered a significant cybersecurity breach after a hacker group claimed to have accessed approximately 70,000 identity records and 59,460 mobile numbers. The group, identified as Scarlettgroup, has allegedly offered the data for sale on a cybercrime forum, raising concerns about the security of sensitive law enforcement information.
The claims were reported on October 21, 2026. However, the breach has not been independently verified, and Rajasthan Police had not publicly commented on the allegations at the time of reporting.
What Data Do the Hackers Claim to Have Stolen?
According to reports, Scarlettgroup claims to possess approximately 6.63 GB of attachments containing sensitive documents and personal information. The alleged dataset includes electronic Know Your Customer (eKYC) documents, First Information Reports (FIRs), witness statements, investigation files, identity cards, salary slips and bank statements.
The group has also claimed access to email accounts belonging to senior police officials, including a director and an inspector general.
The hackers reportedly shared redacted images of sample documents as evidence of their claims. They allegedly offered to provide unredacted versions to buyers, although no specific asking price was disclosed.
If authentic, the material could expose both ordinary citizens and individuals connected to police investigations.
Why Is This Alleged Breach Serious?
Police databases can contain information that is considerably more sensitive than ordinary customer records. FIRs and investigation documents may include complainant details, witness identities, allegations of criminal activity and information about ongoing cases.
Exposure of such information could create several risks.
First, criminals could use leaked identity documents and mobile numbers for impersonation, phishing, identity theft and financial fraud. Second, leaked witness statements or investigation files could compromise the privacy and safety of people involved in legal proceedings. Third, access to official email accounts, if genuine, could expose confidential communications or provide attackers with opportunities for further cyberattacks.
The potential consequences would depend on the authenticity, completeness and currency of the allegedly stolen information.
Who Is Scarlettgroup?
Scarlettgroup is the hacker group named in the reports about the alleged Rajasthan Police breach. The group reportedly announced the claimed intrusion on BreachForums, an online forum associated with cybercrime-related disclosures and stolen data listings.
However, a hacker group’s claim of responsibility does not establish that an attack occurred exactly as described. Sample documents can also be misrepresented, recycled from older breaches or presented without sufficient evidence of their origin.
Independent technical verification and an official investigation would be needed to establish whether the records genuinely originated from Rajasthan Police systems and how any unauthorised access occurred.
What Should Potentially Affected Citizens Do?
Until the claims are verified, citizens should remain cautious rather than assume that their information has definitely been compromised.
People who receive unexpected calls or messages referencing police complaints, identity documents or supposed investigations should verify the sender through official channels. They should avoid sharing OTPs, banking credentials or additional identity documents with unverified contacts.
Organisations handling sensitive government information should review access controls, authentication systems, server logs and data-exposure risks. If a breach is confirmed, authorities should establish the affected systems, notify impacted individuals where appropriate and take steps to prevent further disclosure.
A Larger Warning About Government Cybersecurity
The alleged incident highlights the potential consequences of inadequate protection for public-sector databases. Government systems may hold information about millions of citizens, and a compromise involving police records could affect not only privacy but also criminal investigations and public trust.
For now, the key distinction is that the figures and stolen-data claims remain unverified. The next important development will be confirmation from Rajasthan Police or independent cybersecurity investigators.
Summary
A hacker group called Scarlettgroup claims to have breached Rajasthan Police systems and obtained 70,000 identity records, 59,460 mobile numbers and approximately 6.63 GB of documents. The alleged data includes eKYC records, FIRs, witness statements and bank statements. The breach remains unverified, and authorities had not publicly commented at the time of reporting. If confirmed, the incident could pose serious privacy, identity theft and investigation-security risks.
