Illustration: NewsPlainly. Not a photograph of the event.
Why it matters
If the ATS account holds, hoax threats to schools and public places are being sent from accounts made and sold in bulk, which is why blocking one sender has not stopped the next.
The Uttar Pradesh Anti-Terrorism Squad (UP ATS) has asked Google to block more than 20 lakh Gmail accounts it says were found on the laptop of a Kanpur man arrested over hoax bomb threats, the Indian Express reported early on Saturday, 14 November 2026. The accused, 24-year-old Ankit Shankhwar, was arrested by the squad, a specialised unit of the state police, on 28 October.
A senior ATS officer told the newspaper that the agency sent an online request with a covering letter to Gmail’s office in California, attaching a list of the accounts. The aim is to stop them being used again. Google’s reply was not part of the report.
What the UP ATS says the accused did
According to the agency, Shankhwar created fake email accounts in bulk under made-up identities and sold them abroad for cryptocurrency. “During questioning, the accused disclosed that he had been creating fake email IDs since 2021,” the ATS said in a statement quoted by the Times of India. It added that he used Wi-Fi connections and proxy networks, which hide where an account was made.
Officials told the Indian Express that he sometimes bought existing accounts, reset their passwords and resold them, and that he found buyers through Facebook groups that trade such accounts. Through those groups, the ATS says, he came into contact with people in Pakistan, Bangladesh, Turkey, Egypt and other countries. These are the agency’s allegations; they have not been tested in court, and the reports read did not carry a response from the accused or a lawyer.
From 5 lakh accounts to more than 20 lakh
The count of fake email accounts has grown as the devices were examined. A first look at the seized laptop showed Excel files, cryptocurrency wallets and nearly 5 lakh email IDs, the ATS said, according to the Indian Express. Further examination took the total past 20 lakh accounts.
NewsPlainly’s calculation: 20 lakh is 2 million accounts. Spread evenly over the roughly five years since 2021 that the ATS says he was at it, that would be about 1,100 accounts a day. The ATS has not given a daily figure; the calculation only shows the scale of what is alleged.
The threats the agency links to the accounts
The case began with emails to schools around Delhi NCR (the National Capital Region). The ATS said it received intelligence on 12 October about threats sent from one email ID, in the name of the Khalistan National Army and Babbar Khalsa. They threatened blasts at schools in Gautam Buddh Nagar (Noida), Delhi and Gurugram, a Delhi NCR show by Punjabi singer Diljit Dosanjh and the home of a well-known Bollywood actor.
Technical checks traced that account to Kanpur Nagar district, the ATS said, which led investigators to Shankhwar in the Ghatampur area. A second ID found on his devices was used on 23 October to send a bomb threat to the Mumbai Mayor’s office, according to the agency.
On 13 November, the ATS said accounts he made were also behind the hoax emails sent to Mumbai on 12 November, the Times of India reported. The agency claims he sold them to a Bangladeshi national it named as Amin, and that he received $50,000 (about ₹47.12 lakh) from Turkey and Egypt for supplying accounts.
| Date | What happened, according to the UP ATS |
|---|---|
| Since 2021 | Accused allegedly begins making fake email IDs |
| 12 October 2026 | ATS gets intelligence on threat emails to schools in Noida, Delhi and Gurugram |
| 23 October 2026 | Bomb threat sent to the Mumbai Mayor’s office from an ID later found on his devices |
| 28 October 2026 | Ankit Shankhwar arrested by the UP ATS |
| 12 November 2026 | Hoax emails to Mumbai targets, which the ATS links to accounts he made |
| 14 November 2026 | Indian Express reports the ATS request to Google to block 20 lakh+ accounts |
The timeline is NewsPlainly’s, built from the two reports; every entry is an ATS claim as reported.
Targets named in the Mumbai emails
The 12 November emails named the Brihanmumbai Municipal Corporation headquarters, the Mumbai Mayor’s office, Chhatrapati Shivaji Maharaj International Airport and actor Amitabh Bachchan’s bungalow, Jalsa, in Juhu, the Times of India reported. Mahalaxmi Stadium and several bank branches, including Punjab National Bank branches in south and central Mumbai, were also listed. Police checked the places and tightened security, the paper said.
What happens next in the case
Three steps are on record. The ATS plans to seek his police custody remand again, citing fresh evidence from his phone and laptop, the Indian Express reported. The request to Google is pending, and the reports did not say how many of the fake email accounts are still active or whether any have been blocked. The agency is also checking whether accounts from the same network were behind hoax bomb threats about a Diljit Dosanjh concert in Madhya Pradesh and a court complex in Gwalior, the Times of India reported.
Until a charge sheet is filed, the account of what he did comes from the ATS alone, and any case against him will be decided in court.
What schools and parents in Delhi NCR can take from this
The case explains why such threats keep arriving from new addresses: the ATS says accounts were made in lakhs and sold on, so blocking one sender does not stop the next. The emails to Noida, Delhi and Gurugram schools in October were hoaxes. Schools and parents should still follow police instructions each time a threat arrives, since only a check on the ground can rule out danger.
For more news from the state, see NewsPlainly’s Uttar Pradesh page.
Frequently asked questions
Why has UP ATS asked Google to block 20 lakh accounts?
The ATS says the accounts were found on the laptop of a man arrested over hoax bomb threats and wants them blocked so they cannot be misused, the Indian Express reported.
Who is the accused in the UP ATS fake email case?
Ankit Shankhwar, 24, of Ghatampur in Kanpur Nagar, arrested by UP ATS on 28 October 2026. The allegations against him have not been tested in court.
Which hoax bomb threats does the ATS link to him?
Threats to schools in Noida, Delhi and Gurugram in October, a threat to the Mumbai Mayor's office on 23 October, and hoax emails to Mumbai targets on 12 November, according to the ATS.