Operation Sindoor: NIA raids Delhi and four states over cyberattacks on government websites

The National Investigation Agency has carried out coordinated searches across five states and Delhi while investigating an alleged cyber-terrorism plot involving attempted DDoS attacks on dozens of Indian government websites during Operation Sindoor last year.

The National Investigation Agency (NIA) has widened its investigation into an alleged cyber-terrorism case linked to Operation Sindoor, conducting searches across five locations in different parts of the country and seizing digital material that it says is connected to hacking activities.

The searches, carried out on Monday, covered premises in Maharashtra, Gujarat, Telangana, Bihar and Delhi. The investigation centres on an alleged attempt to disrupt Indian government websites and critical information infrastructure through distributed denial of service, or DDoS, attacks during the period of heightened tensions between India and Pakistan last year.

According to the NIA, the case concerns attempted attacks on 54 websites belonging to government entities. Investigators are examining whether those involved had received technical assistance or training to develop the capability required to launch such attacks.

The federal agency took over the matter after an FIR was registered by Gujarat Police in June last year.

The NIA said its investigation had identified individuals suspected of helping the accused prepare for the alleged cyber attacks and improve their technical skills.

“During the course of investigation, suspects who provided support and assistance to the accused in the preparation and skill upgradation for carrying out the DDoS attacks were identified through thorough technical analysis,” the agency said.

warrants were subsequently obtained from a competent court, leading investigators to locations in Junnar in Maharashtra's Pune district, Nadiad in Gujarat's Kheda district, Ramagundam in Telangana's Karimnagar district, Gopalganj in Bihar and Delhi.

Officials recovered several electronic devices and documents during the operation. The NIA said the material contains evidence it considers relevant to the alleged hacking activities, though it did not disclose the identities of those searched or provide further details the devices seized.

A DDoS attack typically involves overwhelming a website or online service with a large volume of traffic, potentially making it inaccessible to legitimate users. In this case, the NIA has alleged that the targets included critical computer resources and infrastructure classified as critical to the functioning and security of the country.

The agency said the alleged attacks were intended to compromise India's sovereignty, security and unity and create fear among the public. The investigation remains ongoing.

The alleged cyber activity occurred during Operation Sindoor, India's military response to the April 22, 2025, terrorist attack in Pahalgam, Jammu and Kashmir, in which 26 people were killed.

India launched Operation Sindoor in the early hours of May 7, targeting nine terrorist camps in Pakistan and Pakistan-occupied Kashmir. The strikes marked the beginning of several days of escalating military exchanges across the western border.

The confrontation involved fighter aircraft, missiles, drones and artillery fire. On the night of May 9 and 10, the Indian Air Force struck targets associated with Pakistani air bases and military installations.

The hostilities came to a halt on the evening of May 10 after an understanding was reached between the two countries.

It was against this backdrop that investigators say attempts were made to target Indian government websites. The NIA's latest searches suggest that the probe has moved beyond the individuals accused of directly carrying out the alleged attacks and is now examining the wider network that may have provided technical or logistical support.

The agency has not said whether any arrests were made during Monday's operation. Further forensic examination of the seized digital devices and documents is expected to form part of the continuing investigation.