Gujarat bomb threats: Email trail traced to Bangladesh, Pakistan
Synopsis
Two bomb threat emails targeting 35 locations in Gujarat — schools, courts, and Narendra Modi Stadium — have been traced to accounts apparently operated from Bangladesh and Pakistan. The trail reveals a cryptocurrency-funded network that buys hacked Gmail accounts on Telegram, with a prior accused already arrested in West Bengal, pointing to a structured transnational operation timed around public events.
Key Takeaways
Ahmedabad Cyber Crime Branch traced two bomb threat emails, received on 7 October and 27 October , to accounts apparently operated from Bangladesh and Pakistan .
The threats named 35 locations in total, including 24 schools , the Mayor's Office , multiple courts, and Narendra Modi Cricket Stadium in Motera .
Both emails invoked Khalistani organisations and threatened attacks tied to Diljit Dosanjh's show at the stadium on 21 November .
An earlier linked case led to an arrest in West Bengal ; the accused had sold hacked Gmail accounts to a Bangladesh-based individual, who then passed them to a contact in Pakistan in exchange for cryptocurrency .
Cases registered under Sections 351(3), 351(4), 353(1)(b) and 61 of the Bharatiya Nyaya Sanhita , and Section 66(c) of the IT Act, 2000 .
Investigation is ongoing in coordination with central agencies .
The Ahmedabad Cyber Crime Branch on Wednesday, 28 October 2026, revealed that two separate bomb threat emails targeting 35 locations across Gujarat — including schools, courts, government offices, and Narendra Modi Stadium in Motera — were apparently routed through Bangladesh and Pakistan using compromised email accounts. The threats, received on 7 October and 27 October, have prompted two formal cases and a coordinated probe with central agencies.
The Two Threat Emails: What Was Sent
The first email, received on 7 October, targeted 16 locations, including 10 schools, the Mayor's Office, the Gujarat High Court, the Sola court, the Metro Court at Gheekanta, the District and Sessions Court in Ahmedabad, and Narendra Modi Cricket Stadium. It carried the subject line 'Time B00 MB at Gujarat Schools. @11:11AM' and was sent from the addresses bonnieeubanks49@gmail.com and kwajids@gmail.com.
The message invoked Khalistani organisations, urged people not to attend shows by Punjabi singer and actor Diljit Dosanjh, and threatened explosions at Narendra Modi Stadium on 21 November and at Delhi's JLN Stadium on 1 November. It also referenced the 1984 anti-Sikh violence and named groups including the Khalistan National Army and Babbar Khalsa.
The second email, received on 27 October from reduak079@gmail.com, bore the subject line 'Warning! BOMB Blast Ahmedabad Schools @ 1:11 PM' and threatened 19 locations — among them 14 schools, the Mayor's Office, two offices at Danapith, the Metro Court at Gheekanta, the City Civil Court in Ahmedabad, and Narendra Modi Cricket Stadium. It again invoked Khalistani outfits, warned of bomb attacks linked to Dosanjh's 21 November show, referenced iPhone-based explosives, and cautioned people against travelling through Motera Stadium Metro Station on 21 November.
Email Trail: Bangladesh and Pakistan Links
Police examined email headers and information obtained from Gmail to trace the origin of both messages. Preliminary findings indicate that the accounts used were operated from across the border. According to officials, the 7 October email was traced to accounts apparently operated from Bangladesh and Rawalpindi in Pakistan, while the 27 October email appeared to have been operated from Rangpur in Bangladesh and Lahore in Pakistan.
Investigators believe individuals based in Pakistan were allegedly sending bomb threat emails ahead of festivals and significant events to create fear and panic. They were reportedly sourcing previously compromised email accounts from individuals in Bangladesh and elsewhere through Telegram and WhatsApp groups.
The Cryptocurrency–Hacked Account Chain
The current probe has drawn on intelligence from an earlier, related case involving similar Khalistani-themed bomb threats. In that investigation, an accused was arrested in West Bengal. Police found that the individual had sold hacked Gmail accounts to a person based in Bangladesh.
During further questioning, according to officials, the Bangladesh-based individual disclosed that he sold the accounts to a contact in Pakistan and received payments in cryptocurrency. This suggests a structured transnational network — originating in India, moving through Bangladesh, and terminating in Pakistan — that exploits compromised digital credentials for threat operations.
Legal Action and What Happens Next
The Cyber Crime Branch has registered cases under Sections 351(3), 351(4), 353(1)(b) and 61 of the Bharatiya Nyaya Sanhita, along with Section 66(c) of the Information Technology Act, 2000. Police teams visited all affected schools and court premises as part of the initial response.
Investigations into both cases are continuing in coordination with central agencies. With Diljit Dosanjh's show at Narendra Modi Stadium scheduled for 21 November, security authorities are expected to heighten vigilance at the venue and along the Motera Metro corridor in the weeks ahead.
Point of View
Monetised in Bangladesh via cryptocurrency, then weaponised in Pakistan — is a textbook example of how low-cost digital infrastructure is being exploited for psychological operations against India. What is notable is the precision of timing: threats are reportedly issued ahead of festivals and high-profile public events, maximising panic with minimal operational risk to the perpetrators. The Diljit Dosanjh angle adds a cultural-intimidation dimension that goes beyond the immediate security threat, echoing a pattern of targeting diaspora-facing events to amplify Khalistani messaging. The bigger question is whether India's cross-border cybercrime legal mechanisms — strained at the best of times with Bangladesh, and effectively absent with Pakistan — can keep pace with a network that routes threats through Telegram, WhatsApp, and cryptocurrency with near-total deniability.
NationPress
28 Oct 2026
Frequently Asked Questions
What bomb threats were issued in Gujarat in October 2026?
Two separate bomb threat emails were sent on 7 October and 27 October 2026, naming 35 locations across Ahmedabad including 24 schools, the Mayor's Office, multiple courts, and Narendra Modi Cricket Stadium. Both emails invoked Khalistani organisations and were linked to Diljit Dosanjh's planned show on 21 November.
Where were the bomb threat emails traced to?
According to the Ahmedabad Cyber Crime Branch, the 7 October email was traced to accounts apparently operated from Bangladesh and Rawalpindi in Pakistan, while the 27 October email appeared to have been operated from Rangpur in Bangladesh and Lahore in Pakistan.
How were the hacked email accounts obtained?
Investigators found that compromised Gmail accounts were being traded through Telegram and WhatsApp groups. In a related earlier case, an accused arrested in West Bengal was found to have sold hacked accounts to a Bangladesh-based individual, who then sold them to a Pakistan-based contact in exchange for cryptocurrency.
What legal action has been taken?
The Cyber Crime Branch has registered cases under Sections 351(3), 351(4), 353(1)(b) and 61 of the Bharatiya Nyaya Sanhita, and Section 66(c) of the Information Technology Act, 2000. The investigation is continuing in coordination with central agencies.
Is Narendra Modi Stadium still under threat ahead of the November 21 event?
Both emails specifically threatened Narendra Modi Cricket Stadium on 21 November, coinciding with a Diljit Dosanjh show. Police visited the affected premises and security agencies are expected to heighten vigilance at the venue and along the Motera Metro corridor ahead of the event.
