NEET portal hack: Bihar youth arrested in Gujarat for diverting ₹1,700 refunds
Synopsis
A 19-year-old from Bihar allegedly cracked passwords of around 150 NEET candidates using brute-force software and swapped their bank details with his own to pocket ₹1,700 government refunds — exposing a glaring gap in the NTA portal's security. The breach has now forced the NTA to roll out two-factor and Aadhaar-linked authentication, raising questions about why such basics were missing from a system handling millions of students.
Key Takeaways
Navinkumar Yadav , 19, from Gaya district, Bihar , was arrested by the Ahmedabad Cyber Crime Branch for allegedly hacking NEET UG-2026 portal accounts.
He allegedly targeted approximately 350 student accounts and successfully breached around 150 using brute-force software.
The motive was to divert ₹1,700 per-student refunds — announced after the cancellation of the previous NEET exam — into his own bank account.
The breach was detected by the NTA's Chief Information Security Officer (CISO) through digital footprint analysis and human intelligence.
More than 150 students have been affected; relevant bank accounts have been frozen and refunds will be issued after the investigation.
The NTA is now implementing two-factor authentication , OTP-based verification , and Aadhaar-linked verification to secure the portal.
The Ahmedabad Cyber Crime Branch has arrested a 19-year-old Bihar resident, Navinkumar Yadav, a BSc graduate from Bhareti, Gaya district, for allegedly hacking into NEET UG-2026 portal accounts and attempting to redirect candidate refund payments to his own bank account. The arrest, made in coordination with the National Testing Agency (NTA), follows the government's announcement of ₹1,700 refunds to students after the cancellation of the previous NEET examination.
How the Hack Was Carried Out
According to police, Yadav allegedly exploited critical weaknesses in the NEET portal's password recovery mechanism, which relied on easily guessable security questions such as favourite colour and favourite sport. Using software-assisted brute-force tools, he reportedly cycled through combinations until he cracked student passwords.
Police alleged that Yadav targeted approximately 350 NEET candidate accounts and successfully breached around 150 of them due to weak password choices. Once inside, he allegedly changed the account passwords and replaced the registered bank account details with his own, so that refund transfers would be redirected to him instead of the rightful candidates.
How the Accused Was Traced
The case came to light after the NTA's Chief Information Security Officer (CISO) flagged suspicious activity. The CISO immediately shared digital footprint data generated through the portal's security logs, enabling investigators to identify the suspect and trace his location. Police said the detection relied on a combination of technical analysis of bank account details and human intelligence inputs, leading to Yadav's arrest in Bihar.
A case has been registered under relevant provisions of the Bharatiya Nyaya Sanhita and the Information Technology Act.
What Officials Said
Joint Commissioner of Police (Crime) Sharad Singhal confirmed at a press conference that more than 150 students had been affected, and that the number could rise as the investigation continues. 'Cyber criminals exploited vulnerabilities in the password recovery system and targeted student accounts,' he said.
Singhal added that relevant bank accounts had been frozen and that affected students would be refunded once the investigation concludes. 'Authorities were working to identify where the money had gone,' he said.
NTA Director Akash Jain acknowledged that initial shortcomings may have existed in the refund system. 'Lessons learned from the investigation have helped strengthen the portal's security features,' he said.
Security Overhaul at NTA
The breach has prompted a significant upgrade to the NEET portal's security architecture. Two-factor authentication, which was previously unavailable on the affected section, is now being implemented by the NTA. According to Jain, OTP-based verification and Aadhaar-linked verification have also been incorporated to prevent further unauthorised access through security question exploitation.
The Cyber Crime Branch has advised students and parents to use strong passwords combining uppercase and lowercase letters, numbers, and special characters, and to avoid simple choices such as names, dates of birth, or mobile numbers. Candidates were also urged to access only the official NTA and NEET websites for examination and refund-related processes.
What Happens Next
The investigation is ongoing, and police have not ruled out additional arrests. Affected students are expected to receive their refunds once the probe is complete and frozen accounts are verified. The NTA's security overhaul, if implemented rigorously, could set a new baseline for portal security across competitive examination bodies in India.
Point of View
But it arrives too late for the students whose refunds were redirected. More troubling is the pattern: NEET has faced integrity craestions repeatedly, and each time the response is reactive. India's largest examination body cannot afford to treat security as an afterthought when the stakes — careers, livelihoods, and public trust — are this high.
NationPress
1 Aug 2026
Frequently Asked Questions
Who was arrested in the NEET portal hacking case?
Navinkumar Yadav, a 19-year-old BSc graduate from Bhareti in Gaya district, Bihar, was arrested by the Ahmedabad Cyber Crime Branch. He was detained in Bihar following a joint investigation with the NTA.
How did the accused hack NEET candidate accounts?
According to police, Yadav used software-assisted brute-force tools to exploit weak security questions — such as favourite colour and favourite sport — in the NEET portal's 'Forgot Password' recovery system. He allegedly cracked passwords of around 150 student accounts and replaced their bank details with his own.
Why were NEET refunds being issued?
The government announced refunds of ₹1,700 per candidate following the cancellation of the previous NEET examination. It was this refund process that the accused allegedly targeted to divert payments into his own account.
What happens to the students whose accounts were compromised?
More than 150 students have been affected, according to Joint Commissioner of Police Sharad Singhal. Relevant bank accounts have been frozen, and authorities have said affected students will be refunded once the investigation is complete.
What security changes has the NTA made after the breach?
NTA Director Akash Jain confirmed that two-factor authentication, OTP-based verification, and Aadhaar-linked verification have been introduced to secure the portal. Two-factor authentication was previously unavailable on the section that was exploited.
