NIA raids 5 states over DDoS attacks on govt sites during Op Sindoor
Synopsis
The NIA has widened its cyber-terrorism dragnet to five states, raiding premises linked to suspects who allegedly helped orchestrate DDoS attacks on 54 Central government websites during Operation Sindoor. With two already arrested and digital devices now seized, the probe signals India is treating coordinated cyberattacks on state infrastructure as a national security threat on par with physical terrorism.
Key Takeaways
The NIA conducted searches at five locations across five states on 24 August in a cyber-terrorism case linked to Operation Sindoor .
Suspects allegedly attempted DDoS attacks on 54 Central government websites , targeting Critical Information Infrastructure.
Raids covered Junnar (Maharashtra) , Nadiad (Gujarat) , Ramagundam (Telangana) , Gopalganj (Bihar) , and Delhi .
Three laptops , five mobile phones , and other digital devices including pen drives were seized.
The case was originally registered by the Gujarat ATS on 25 June before the NIA took over; two accused are already under arrest.
The National Investigation Agency (NIA) on Monday, 24 August conducted simultaneous searches at five locations across five states as part of its probe into a cyber-terrorism case involving attempted distributed denial-of-service (DDoS) attacks on 54 Central government websites during Operation Sindoor. The searches mark a significant escalation in what investigators have described as a coordinated assault on India's Critical Information Infrastructure (CII).
Where the Raids Were Conducted
NIA teams fanned out to premises in Junnar in Maharashtra's Pune district, Nadiad in Gujarat's Kheda district, Ramagundam in Telangana's Karimnagar district, Gopalganj in Bihar, and Delhi. The operations were carried out on Monday morning following search warrants issued by a competent court.
Background and Case History
The case was originally registered by the Gujarat Anti-Terrorism Squad (ATS) on 25 June last year before the NIA took over the investigation. According to the agency, the accused allegedly attempted sophisticated DDoS attacks targeting government websites, critical computer resources, and CII during Operation Sindoor — with the stated intent of compromising India's national sovereignty, security, and unity and inciting public fear.
This is not the first time the NIA has pursued cases involving alleged cyberattacks on government infrastructure, but the scale — 54 targeted websites across Central government entities — makes this among the more significant cyber-terrorism probes in recent years.
What Was Seized
NIA teams seized several digital devices and documents containing allegedly incriminating material related to hacking activities. Officials confirmed that three laptops, five mobile phones, and other digital devices including pen drives were recovered following due procedure. Suspects at each location were also questioned about their alleged association with the two accused already under arrest.
Role of the Newly Identified Suspects
According to the NIA, technical analysis during the investigation identified the suspects as individuals who allegedly provided support and assistance to the arrested accused — including helping them prepare for and sharpen their skills to execute the DDoS attacks. The agency has not yet disclosed whether fresh arrests followed Monday's searches.
What Comes Next
The NIA confirmed its investigation is continuing. With digital devices now in custody, forensic analysis is expected to determine the full extent of the network and any cross-border links. The case could have significant implications for how India prosecutes cyber-terrorism offences tied to active military operations.
Point of View
Not merely cybercrime. The timing — attacks allegedly timed to Operation Sindoor — raises questions about external coordination that the agency has not yet addressed publicly. The Gujarat ATS origin of the case, combined with NIA's takeover, suggests investigators believe the threat has national dimensions. The real test will come in court, where the legal threshold for 'cyber-terrorism' under the IT Act remains relatively untested at this scale.
NationPress
25 Aug 2026
Frequently Asked Questions
What is the NIA cyber-terrorism case linked to Operation Sindoor?
It is a case involving alleged DDoS attacks on 54 Central government websites during Operation Sindoor, with the stated intent of compromising India's national sovereignty and inciting public fear. The case was first registered by the Gujarat ATS on 25 June before the NIA took over the investigation.
What is a DDoS attack and why is it considered cyber-terrorism here?
A distributed denial-of-service (DDoS) attack floods a website or server with traffic to make it inaccessible. In this case, the NIA has classified the alleged attacks as cyber-terrorism because they targeted Critical Information Infrastructure of the Central government during an active military operation, Operation Sindoor.
Which states were covered in the NIA raids on 24 August?
The NIA conducted searches in Maharashtra (Junnar, Pune district), Gujarat (Nadiad, Kheda district), Telangana (Ramagundam, Karimnagar district), Bihar (Gopalganj), and Delhi — five states in total.
What was seized during the NIA searches?
Officials confirmed that three laptops, five mobile phones, and other digital devices including pen drives were seized. Documents containing allegedly incriminating material related to hacking activities were also recovered.
Have any arrests been made in this case?
Two accused have already been arrested prior to Monday's raids. The newly searched suspects are alleged to have provided support and training assistance to the arrested accused; the NIA has not confirmed whether fresh arrests followed the 24 August searches.
