Beginning in late April 2024, a series of hoax bomb threatsâÂÂcommunicated via emails and phone callsâÂÂwere reported across multiple locations in India. Targets included schools, colleges, hotels, hospitals, airports, and aircraft. The majority of threats were directed at institutions in Delhi.
During late April 2024, a wave of bomb threats targeted multiple airports and facilities across India. Kolkata and Jaipur airports received emails claiming that bombs had been planted on their premises. In addition, airports in Mumbai, Bhopal, Goa (Dabolim), and Kolkata also received hoax bomb threat calls.
The following day, more than 30 airports under the jurisdiction of the Airports Authority of India (AAI) and other agencies received bomb threats via email. The threats were reportedly sent to over 90 email addresses belonging to airports and security organizations.
On 1 May, over 200 schools in the Delhi-NCR received identical bomb threat emails around 04:00, prompting mass evacuations and panic among parents. After thorough searches, the threats were deemed hoaxes. An initial investigation by the Delhi Police Special Cell's Counter-Intelligence Unit (CIU) traced the source to a Russian IP address linked to the email ID 'sawariim@mail.ru'.
Schools targeted included Sanskriti School in Chanakyapuri, Mother Mary School in Mayur Vihar, and Delhi Public School branches in Dwarka and Noida.
On 6 May, 41 schools in Ahmedabad, Gujarat, received similar bomb threat emails. On 12 May, Delhi hospitals, including Indira Gandhi International Airport, and the Northern Railwaysâ office were targeted with alarming emails from a Cyprus-based service, beeble.com.
In mid-May, private hospitals in Bengaluru also received hoax threat emails. On 14 May, the 16th anniversary of the 2008 Jaipur bombings, over 55 schools in Jaipur were targeted with similar emails.
That same day, hospitals and Tihar Jail in Delhi also received threats from the same Cyprus-based service.
On 15 May, a bomb threat note was found in the washroom of a DelhiâÂÂVadodara Air India flight, sparking panic before being deemed a hoax.
By late May, threats extended to commercial and government sites. On 19 May, Mumbai Police received a threat call about a bomb at a McDonaldâÂÂs outlet in Dadar. On 22 May, the North Block, housing the Ministry of Home Affairs (MHA), received a hoax bomb threat email from an anonymous Gmail ID using a suspected VPN.
On 23 May, three hotels in Bengaluru, including the Oterra Hotel in Electronic City, received bomb threats via email. The sender, identifying himself as "daudee jiwal", claimed to be the son of a senior IPS officer and alleged a conspiracy involving the ISI and a political family from Tamil Nadu. He warned that some members of the Bomb Detection and Disposal Squad (BDDS) were under his fatherâÂÂs supervision and advised evacuations by 14:30.
In early October 2024, at least 30 Indian flights received bomb threats. During the last two weeks of the month, the aviation sector reported at least 500 hoax bomb threats. As of 14 November, a total of 999 fake threats had been recorded for the yearâÂÂten times more than the previous year.
Notable incidents included:
Indian authorities arrested a 17-year-old school dropout who allegedly created a fake social media account to issue bomb threats. He was believed to have targeted four flights.
On 9 December 2024, over 40 schools in Delhi received bomb threat emails demanding a ransom of US$30,000. The messages threatened that students would be harmed by multiple small explosives hidden on school premises, leading to widespread panic and evacuations.
On the same day, six hotels in Gurugram also received bomb threats, causing alarm among guests and staff. Bomb squads and local police were dispatched to the affected locations; however, no explosives were found during search operations. Authorities stated that efforts were underway to trace the IP addresses from which the threat emails originated.
The bomb threat emails received by schools in Delhi are suspected to have originated from Budapest, Hungary. According to police officials, the IP address of the anonymous sender was traced to the Hungarian capital. Authorities also reported that the emails were sent via mail.ru, a Russian-based email service, and that a formal request had been sent to the provider for further information. Delhi Police stated they were planning to contact law enforcement agencies in Hungary to assist with the investigation. Preliminary findings raised suspicions of a âÂÂdeeper conspiracy,â possibly involving an ISIS-linked module attempting to disrupt the ongoing general election.
The Lieutenant Governor of Delhi, Vinai Kumar Saxena, requested a detailed report from the state police and directed them to carry out search operations and identify the perpetrators without delay. He urged parents to remain calm and cooperate with the authorities.
Cybercrime officials initiated an investigation after a FIR was registered by the Kanpur Police. Authorities were also examining similarities between the threat emails received by schools in Lucknow, Bengaluru, Jaipur, and Delhi, in an effort to identify patterns and possible connections.
On 29 May, the Hyderabad City Police arrested a man accused of making hoax bomb threat calls regarding explosives planted at Praja Bhavan and the Nampally Court. According to police reports, the suspect admitted to making the calls while in an intoxicated state, following a domestic dispute with his wife.