InfoSecBulletin Cybersecurity for mankind
Hacker offers to sell Rajasthan Government’s Department of Information Technology & Communication (DoIT&C) data in a underground forum.
The threat actor claims “We have breached Rajasthan Police, and its data is now available for purchase,” Scarlettgroup said on the forum. The hackers claim that they have access to around 70,000 identity records, and 59,460 mobile numbers. The group says it also obtained details about FIRs, eKYCs, and witness statements.
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
According to the claimed exposure:
• 5,926 mailboxes containing 8.63 million emails
• 22,686 attachments (6.63 GB)
• 783,495 unique email addresses
• 70,301 identity records
• 59,460 mobile numbers
• 69 verified credentials
• 21 VPN logins and 64 VPN certificates
• 1,065 senior officer mailboxes
The posted sample data reportedly include government communications, financial records, KYC documents and internal access information. If true, it could expose as much as 70,000 identity records, 59,000 mobile numbers, millions of emails, and more.
On X, cybersecurity account FalconFeeds.io first reported the breach. As per the post, a hacker group called “Scarlettgroup” is behind the incident. Scarlettgroup has shared details about the incident on BreachForums, a dark web forum.
Indiatoday reported “Scarlettgroup attached redacted images of sample documents from the data set. They say that unredacted versions of them would be provided upon purchase. Though no price was given for the sale. The group claims that they will be selling the data to multiple buyers”.
At the time of publishing, no official statement was found on these claims publicly, and infosecbulleltin could not independently verify and confirm the authenticity of the breach.
However, the authenticity, attribution, and full extent of the claimed breach remain unverified. We cannot claim whether this data is genuine or if it came directly from the Rajasthan Police website.
