Indore police have traced bomb threat emails sent ahead of singer Diljit Dosanjh’s November 15 concert to the hacked email account of a 22-year-old IT professional from Dewas, according to the Crime Branch. Investigators are now trying to identify the person who allegedly accessed the account and used it to send the threats.
The emails were sent to three private schools and the office of the Indore mayor in connection with Dosanjh’s scheduled concert at C-21 Ground. The schools were warned against sending students to the event and were threatened with bomb blasts. Security teams searched the premises after the messages were received but did not find any explosives.
Additional Deputy Commissioner of Police Rajesh Dandotiya said investigators questioned Nikhil Gupta, a native of Birsinghpur Pali who currently lives in Dewas and works for an IT company. Police have recorded Gupta’s statement as part of the investigation.
Preliminary questioning and examination of available digital evidence indicated that Gupta’s email account had allegedly been compromised in March or April 2026. Investigators found attempts to access the account through United States-based IP addresses and virtual private network services, the report said.
The same compromised email ID was subsequently used to send bomb threat messages to several schools, linking the digital trail to the concert-related threats. Police are treating the threats as possible hoaxes, but the investigation remains focused on tracing the unidentified hacker who allegedly gained access to the account.
The case highlights the operational challenge for schools, public offices and event organisers when threats are delivered through compromised digital accounts. While physical searches found no explosives at the locations mentioned in the messages, authorities are continuing to examine the email activity and related digital evidence before reaching conclusions about those responsible.
Dosanjh’s November 15 concert remains the event around which the threats were issued. Police have not identified the suspected hacker, and their next step is to trace the source of the access attempts and establish who controlled the compromised account when the messages were sent.
