Bhubaneswar Commissionerate Police has launched a probe after unidentified cyberattackers allegedly took control of its official X account and used the verified handle to post cryptocurrency-related promotional content, disrupting a key public communication channel during the Durga Puja festivities.
The account was compromised for nearly 24 hours before a team of cyber experts from the Commissionerate Police restored access on Tuesday. A senior police officer said the department had begun an investigation to identify those responsible and determine how the attackers gained entry.
“We have initiated an investigation to identify the people responsible for accessing and misusing our official social media handle. Technical analysis is underway, and we are examining all possible digital footprints left behind by the perpetrators,” the officer said.
The incident took place while citizens were using the police account for traffic advisories and other updates linked to the festival period. The unauthorised cryptocurrency promotions remained visible for several hours on the verified law enforcement account, raising concerns about the reliability of digital channels used by public agencies to communicate during high-demand periods.
Police officials are examining login records, IP traces and account activity to establish how the account was accessed and to identify the origin of the breach. Preliminary findings suggest that the attackers may have used a virtual private network and other anonymising tools to conceal their location, although the investigation is still in progress.
The breach also prompted senior officers to direct the cyber wing to strengthen security arrangements for the department’s official digital platforms and social media accounts. The review includes account access controls and authentication mechanisms, according to police sources cited in the report.
For city administrations and emergency-facing departments, verified social media accounts increasingly function as operational communication infrastructure rather than only public-relations outlets. Traffic diversions, safety instructions and incident updates can depend on residents receiving information quickly from an account they recognise as official. A compromise can therefore affect both the credibility of the message and the public’s ability to distinguish genuine advisories from malicious content.
In this case, the police account was restored by the department’s own cyber experts, but the investigation will determine whether the attackers exploited weaknesses in login management, authentication or another part of the account’s security architecture. The department has not disclosed the specific vulnerability involved or whether any other official systems were affected.
The Commissionerate Police said its technical teams were continuing to analyse the available digital evidence and review security protocols. The next steps are expected to focus on tracing the perpetrators, identifying the method of access and implementing stronger safeguards across the department’s official online channels.
