Delhi NCR Schools Grapple with Persistent Bomb Threat Hoaxes
Educational institutions across Delhi NCR and other major Indian cities faced a disturbing pattern of bomb threat hoaxes throughout 2025 and early 2026. These email-based threats triggered repeated evacuations, emergency searches, and widespread anxiety among students, parents, and school administrations.
The Escalating Pattern of Threats
The wave of hoaxes began in early 2025 and intensified throughout the year. Schools in Delhi NCR experienced multiple surges of threatening emails, with some incidents affecting dozens of institutions simultaneously. The situation reached a peak in late September 2025 when over 300 schools and institutions in Delhi received threat emails within a single morning.
Key incidents included:
- January 2025: Initial threats prompted evacuations at several prominent schools including DPS Vasant Vihar and Amity School Saket
- July 2025: More than 55 schools across Delhi received near-identical emails over several days
- September 2025: The largest single-day incident affected over 300 institutions
- January 2026: Fresh alerts continued the pattern with schools in Noida and Ahmedabad suspending operations
National Spread of the Hoax Phenomenon
While Delhi NCR remained the epicenter of these incidents, the threat pattern spread to other urban centers across India. Bangalore emerged as the second most affected city, with scores of private schools receiving similar hoax alerts. Other cities reporting incidents included Mumbai, Jaipur, Ahmedabad, and various locations in Punjab.
Investigations revealed coordinated patterns, with some threats appearing to originate from the same sources across multiple states. In one multi-state case, authorities traced emails to an individual suspected of using false identities to send threats to schools in Bengaluru, Mysuru, Hyderabad, Chennai, and Ahmedabad.
Security Response and Investigation Findings
Each alert triggered comprehensive security responses involving local police, fire services, and specialized bomb disposal squads. Schools followed established evacuation protocols, informed parents promptly, and suspended classes until thorough searches could be completed.
Authorities identified common characteristics in the threat delivery method:
- Emails sent from encrypted or anonymous services to official school inboxes
- Messages often arriving during early morning hours
- Some threats demanding ransom payments in cryptocurrency
- Repeated appearance of the group name "Terrorisers111" across multiple waves
Despite the alarming nature of these threats, every single incident was confirmed as a hoax following thorough searches by security forces. No explosives were discovered in any of the hundreds of incidents reported across the country.
Long-term Impact and Preventive Measures
The cumulative effect of these repeated alerts created significant disruption to educational activities and placed substantial strain on security resources. Education departments responded by issuing advisories to schools, emphasizing the importance of maintaining calm and obtaining information through official channels.
Schools have been instructed to enhance their preparedness through:
- Regular evacuation drills and exercises
- Review and updating of emergency response plans
- Improved communication protocols with parents and authorities
- Enhanced cybersecurity measures for official communication channels
Cybercrime units across multiple states continue to investigate the digital footprints of these hoaxes, working to identify and apprehend those responsible for orchestrating these disruptive campaigns. The persistence of these threats into 2026 demonstrates the ongoing challenge facing educational institutions and security agencies in maintaining safe learning environments while addressing sophisticated cyber-enabled threats.
