Why hoax bomb threat emails are plaguing Punjab and Tri-city schools and courts with zero arrests

Mohali Senior Superintendent of Police (SSP) Harmandeep Singh Hans stressed that despite the pattern of previous hoaxes, “police are not taking any chances”. No explosives were found, and areas were declared safe after exhaustive searches.

This episode marks the second major scare in Mohali this month. On February 11, 16 private schools—including prominent institutions like Manav Mangal Smart School, Shivalik Public School, Learning Paths School, Yadavindra Public School, and Millennium School—received similar emails, leading to evacuations, holiday declarations, and large-scale police operations involving hundreds of personnel. Again, nothing suspicious was recovered.

The February incidents are only the latest chapter in a series that has intensified since December 2025, primarily hitting educational and judicial institutions across Punjab:

* December 12, 2025: Several prominent private schools in Amritsar received bomb threat emails, triggering evacuations and closures. Anti-sabotage teams conducted searches; no explosives found.

* December 14, 2025: Eleven private schools in Jalandhar were targeted, leading to immediate evacuations and school holidays. Thorough checks by police yielded no suspicious material.

* December 23, 2025: Ryan International School in Patiala’s Urban Estate Phase-II received a bomb threat email at 9.30 am. The campus was evacuated, searched with sniffer dogs and specialised equipment, and declared safe. The school observed a holiday as a precaution.

The wave escalated in January 2026 with threats shifting to judicial complexes:

* January 31: Jalandhar school received a bomb threat a day ahead of Prime Minister Narendra Modi’s visit to Dera Sachkhand Ballan. The email, sent by a person who identified himself as “Billy Hall”, warned of bomb blasts in “three to four schools” in connection with PM Modi’s visit. The message also made references to his proposed visit to Dera Sachkhand Ballan.

* January 29: The district court and the Punjab and Haryana High Court in Chandigarh, the Punjab and Haryana Civil Secretariat in Sector 1, and the Punjab Municipal Bhawan in Sector 35 received bomb threat messages, prompting an immediate security response.

* January 28: Schools in Chandigarh receive bomb threat emails.

* January 9: District courts across multiple Punjab districts—including Ludhiana, Ropar, Ferozepur, Mansa (and sub-divisions), Moga, and Anandpur Sahib—received emails claiming planted explosives or imminent blasts. Courts were evacuated, with over 150 personnel deployed in some places for searches. No explosives were found anywhere.

Similar patterns have hit Punjab-linked institutions in the Tricity region in January, including secretariats and courts, often alongside parallel scares in Chandigarh and Haryana.

What’s common across all incidents

The emails are typically sent from anonymous Gmail accounts, often signed by fictitious names like “Engineer Gurnakh Singh” or directly claiming affiliation with the “Khalistan National Army.” Some contain provocative content referencing “Punjab is Khalistan” or specific blast timings. Authorities in Mohali, Amritsar, Jalandhar, Patiala, and other districts have repeatedly emphasised treating every threat as genuine, while urging the public to avoid rumours. Cyber cells continue digital forensics and coordination with international agencies, but officials privately acknowledge the low probability of identifying perpetrators due to cross-border challenges.

The repeated hoaxes have strained police resources, disrupted education (with frequent school closures and parental anxiety), and raised questions about the psychological and economic toll on institutions. As the series shows no signs of abating—with the latest Fortis Hospital scare occurring amid the CM’s medical treatment—Punjab Police and central agencies say they are reviewing protocols to handle such low-effort, high-disruption cyber threats more

From origin to content, key details based on police reports

* Email ids and content

The bomb threat emails are created using anonymous or throwaway accounts (often Gmail), sometimes under pseudonyms like “M Gill” or signed off as “Engineer Gurnakh Singh Rukan Shahwala”. Content is provocative, often claiming affiliation with the “Khalistan National Army” (or variants like “Khalistan National Army Force”), including slogans such as “Punjab is Khalistan”, “Delhi will become Khalistan”, threats to figures like Punjab CM Bhagwant Mann, references to specific timings (e.g., blasts at 1:11 pm), and inflammatory language.

They are mass-sent in batches to multiple targets (schools, hospitals, courts, government buildings) on the same day or in quick succession.

* IP address and location tracing: The police cyber cells have traced the originating IP addresses of such threat emails to foreign locations. Common traced origins in recent Punjab/Tricity incidents (January–February 2026) include the USA, Bangladesh (Dhaka), France, UK (London), and others like Austria or Germany in prior cases. Punjab’s Special DGP (Cybercrime) V Neerja has reportedly written letters to the Centre seeking international cooperation.

In many instances, emails are routed through servers or accessed from these countries, but police note that senders are “sitting outside the country”, limiting Indian authorities’ ability to act directly.

* Obfuscation techniques: Senders frequently use VPNs (Virtual Private Networks), Tor network, proxies, or other anonymity tools to mask their real location and identity. This explains why traced IPs point to different countries even in coordinated waves, and why investigations often stall despite digital forensics.

* Motivation and nature: All such threats in the current wave (and similar ones dating back to 2024–2025) have been confirmed as hoaxes. No explosives or suspicious items found after evacuations and searches by bomb squads, dog units, etc. Police officials say they appear designed to cause disruption, panic, and resource strain rather than actual harm, often timed around sensitive dates or events.

No credible links to active on-ground terror groups have been established; police describe them as originating from abroad with no actionable leads on perpetrators. “These are low-effort, high-impact cyber hoaxes sent from overseas via anonymised means. Punjab Police and central agencies continue probing, but foreign jurisdiction and obfuscation make arrests rare. However, we treat every threat seriously while advising against spreading rumours,” a senior Punjab Police official said.