# 2024 Indian bomb hoaxes

Starting in late April 2024, numerous bomb threat hoax emails and calls were received by many establishments including schools, colleges, hotels and airports across India, most of which were targeted at organisations in Delhi.

## Threats

During late April, a wave of bomb threats struck various airports and facilities across India. Kolkata and Jaipur airports were targeted with emails claiming bombs had been planted on their premises. Mumbai, Bhopal, Dabolim, and Kolkata airports also received hoax bomb threat calls. The following day, over 30 airports under the authority of Airports Authority of India (AAI) and other airports received a bomb threats by e-mail. The messages were sent to more than 90 email addresses belonging to airports and security agencies.
On 1 May, over 200 schools in Delhi-NCR received an identical message on their official IDs at around 04:00 — an email “threatening to blow up” the premises. The incident triggered mass evacuations of schools and panic among parents. After a thorough check, it was declared a hoax. Following a preliminary probe by the Delhi Police Special Cell's Counter-Intelligence Unit (CIU), the email 'sawariim@mail.ru' was traced to a Russian IP address. Among the targeted schools were Sanskriti School in Chanakyapuri, Mother Mary School in Mayur Vihar, and Delhi Public School in Dwarka and Noida. Similar threats extended to Ahmedabad, Gujarat, where 41 schools received bomb threat emails on 6 May. Meanwhile, hospitals in Delhi, including the Indira Gandhi International Airport, and the Northern railways' office, received alarming emails from a Cyprus-based mailing service company 'beeble.com' on 12 May.
The threats continued in mid-May, with private hospitals in Bengaluru facing similar intimidating emails. On 14 May, the 16th anniversary of the 2008 Jaipur bombings, over 55 schools in Jaipur received bomb threats via email. The same day, several hospitals and even Tihar Jail in Delhi received bomb threats from the same Cyprus-based mailing service company. A crew member on a Delhi-Vadodara Air India flight discovered a threatening message in the aircraft's washroom on 15 May.
Towards the end of May, the threats extended to commercial establishments and government buildings. Mumbai Police received a call about a bomb threat at a McDonald's in Dadar, Mumbai, on 19 May. On 22 May, a bomb threat was received at the North Block, which houses the office of the Ministry of Home Affairs (MHA). The email was sent from an anonymous Gmail address and it was suspected that the sender had used a VPN (virtual private network) that masks the IP address, according to police.
On 23 May, a bomb threat email was received by three hotels in Bengaluru, including the Oterra Hotel situated in Electronic City. The emails were sent by a person who identified himself as daudee jiwal, claiming to be the son of a senior IPS officer. The sender claimed that his father had colluded with Pakistan-based ISI and a Tamil Nadu-based political family to execute the blast, to divert the attention from a drug scandal in which the TN-based political family is involved. The caller also suggested evacuation of the hotels by 14:30. in the e-mail that was sent around 02:30. The sender also asked that Bomb Detection and Disposal Squads (BDDS) be deployed, while warning that some of the BDDS staff were under the "supervision of his father".
On the same day, over a dozen colleges of Delhi University including Hansraj College, Gargi College, Ramjas College, Zakir Husain College, Indraprastha College For Women, Lady Irwin College, Kirori Mal College, Bhaskaracharya College, Deen Dayal Upadhyaya College, Sri Venkateswara College, and PGDAV received bomb threat e-mails.
Delhi Pharmaceutical Sciences and Research University and School of Planning and Architecture (SPA), among other state universities also received the threats.
On May 26, around 2.30 a.m. and 8.30 a.m. the Chennai Airport received two emails, stating that bombs would be planted near the airport and that passengers should be deboarded from the aircraft, followed by a bomb threat call to the Taj Mahal Palace Hotel and Mumbai Airport on 27 May. A Varanasi-bound IndiGo flight faced a similar threat at the Delhi Airport on 28 May, prompting authorities to evacuate all passengers and staff on board. According to police, information was received regarding a paper found in the lavatory of the flight scheduled to depart for Varanasi, with the phrase “bomb @5.30” written on it. The bomb scare prompted authorities to evacuate all the staff and 176 passengers on board.
The official residence and primary workplace of the Chief Minister of Telangana, Praja Bhavan, also received a bomb threat, prompting immediate sealing of the area as police and the bomb disposal squad hurried to initiate a thorough investigation. Bengalore's Kempegowda International Airport was targeted with a bomb threat after a note was discovered in a male washroom at the Alpha 3 building, indicating an imminent series of bomb blasts. Subsequently, on 31 May, a Srinagar-bound Vistara flight received a bomb threat call while en route from Delhi with 177 passengers and one infant on board; however, the aircraft safely landed at Srinagar Airport.
In June, an IndiGo flight traveling from Chennai to Mumbai encountered a bomb threat when a note was found in the lavatory, prompting a full emergency response upon its safe landing at Mumbai Airport.
On 17 August 2024, Gurgaon police received an anonymous email claiming that bombs had been placed in various malls and buildings in Delhi, including the Ambience Mall in Gurugram.
On 6 September 2024, a Vistara flight travelling from Mumbai to Frankfurt made an emergency landing at Erzurum, Turkey after a piece of paper with "bomb on board" written on it was found in a lavatory on the aircraft. On investigation the threat was found to be fake.

### October 2024

In early October 2024, at least 30 Indian flights received bomb threats. During the last two weeks of the month, at least 500 hoax bomb threats were received in the aviation sector. For the year up to 14 November, 999 fake threats were recorded, ten times more compared to the previous year.
* An Air India flight traveling from Mumbai to New York was diverted to New Delhi when a note was discovered in the lavatory of the flight with the message: 'BOMB THIS FLIGHT'. All the passengers and crew were disembarked safely following standard operating procedures.
* An Air India Express plane on its way to Singapore had to be escorted by two air force fighter jets following an e-mail warning that said there was a bomb on board.
* A Lucknow-bound IndiGo flight from Dammam in Saudi Arabia was redirected to Jaipur.
* A Delhi-Chicago Air India flight was diverted to Canada to a security threat that was posted online.
* Two IndiGo flights had to be taken to an isolated bay due to a threat. Both were supposed to take off from Mumbai. One of them was set to go to Muscat and the other to Jeddah.
* Air Akasa flight headed to Bengaluru city was redirected to the capital Delhi.
Indian authorities arrested a 17-year-old school dropout for creating a social media account to issue such threats, he was believed to have targeted four flights.

### December 2024

On 9 December 2024, over 40 schools in Delhi received emails of bomb threats demanding a ransom of $30,000 and saying or else students would be injured by multiple small hidden explosives, causing school evacuations and widespread panic. Also on 9 December, six hotels in Gurugram received bomb threats causing panic. Bomb squads and police officers were called to the hotels, although during a search operation no explosives were found. The police department claimed they are working to trace the IP in which the emails were sent from.

## Investigation

The bomb threat emails received by schools in Delhi are suspected to have been sent from Budapest, Hungary. An officer announced that the IP address of the anonymous sender of the emails had been traced there. The police also said the emails were sent from mail.ru, a Russian server, and had written to the mailing service company. Delhi police were planning to reach out to law enforcement agencies in Hungary to further investigate the issue. Initial investigations had raised suspicions of a "deeper conspiracy" potentially orchestrated by an ISIS module, aimed at disrupting the ongoing general election.
The lieutenant-governor of Delhi Vinai Kumar Saxena requested a comprehensive report from the state police and ordered them to conduct searches and apprehend the culprits without any oversight. Saxena urged parents not to panic and advised them to cooperate fully with authorities.
Cyber Crime officials launched an investigation into the matter after an FIR was registered by Kanpur Police. They were also trying to ascertain patterns between the mails received by schools in Lucknow, Bengaluru, Jaipur, and Delhi.
On 29 May, Hyderabad City Police arrested a man who allegedly made a call about a bomb being planted in Praja Bhavan and Nampally Court. The accused reportedly told police that he made the calls in an inebriated condition after a fight with his wife.