(SDNA) Rajasthan Police Issues Cybersecurity Warning Over Misuse of Official Email Accounts

Reusing Passwords Across Multiple Platforms Could Expose Government Systems to Cyberattacks; Employees Advised to Separate Personal and Official Digital Activities

(SDNA) Jaipur. Rajasthan Police has issued a cybersecurity advisory urging government officers and employees to strengthen the protection of their official email accounts and passwords. The advisory warns that using government email credentials to register on shopping websites, social media platforms, gaming applications and other personal services could expose sensitive government systems to unauthorized access.

The warning also highlights the risks of using the same password across multiple accounts, particularly when personal platforms suffer data breaches that may expose login credentials.

The advisory was issued by the Cyber Branch R4C under the directions of Rajasthan Director General of Police Rajiv Kumar Sharma. Additional Director General of Police (Cyber Crime) V.K. Singh emphasized that stolen or leaked government email credentials could be exploited by cybercriminals to gain access to official accounts and potentially sensitive digital resources.

According to the advisory, the Security Operations Centre (SOC) has also encountered cases involving government email login credentials reportedly available for sale or exposure on the dark web.

One Leaked Password Could Put Government Networks at Risk

Official government email accounts are not used merely for correspondence. They can also serve as access points to Rajasthan’s Single Sign-On (SSO) platform and other important digital services.

Police have cautioned that compromised credentials could expose departmental communications, confidential documents and other sensitive information to unauthorized users. Depending on the access available to a compromised account, the consequences could extend to government digital resources such as SSO, SecLAN and RajSWAN.

A common security mistake is registering for services such as Amazon, Flipkart, Zomato, Facebook, cab-booking platforms or gaming applications with an official government email address while retaining the same password used for government systems.

If one of these private platforms experiences a data breach, attackers may attempt to use the exposed credentials to access the employee’s official account. This technique, known as credential stuffing, exploits password reuse across different services.

Rajasthan Police has therefore stressed that official email credentials must remain separate from personal online accounts.

Warning Signs That an Email Account May Be Compromised

Government employees have been advised to watch for unusual account activity that could indicate unauthorized access or an attempted breach.

Key warning signs include:

• Receiving login alerts or one-time passwords (OTPs) without initiating a login attempt.
• Finding unfamiliar messages in the Sent folder.
• Being automatically logged out of an account or discovering an unexpected password change.
• Seeing emails marked as read despite not having opened them.
• Receiving unusual or suspicious messages apparently sent from colleagues’ official email addresses.

Employees should report suspicious activity promptly rather than ignoring unexpected notifications or attempting to resolve a potentially serious breach without assistance.

Essential Steps to Strengthen Official Email Security

The advisory recommends restricting government email accounts to official work and using personal email addresses for private registrations, subscriptions and online services.

Police have also highlighted several preventive measures:

1. Use a strong, unique password: Employees have been advised to use passwords containing 12–14 characters and, crucially, to avoid reusing the same password across multiple accounts.

2. Enable additional authentication: Multi-factor authentication (MFA) or two-factor authentication should be activated on official email accounts and the government SSO account wherever supported.

3. Remove official email addresses from personal apps: If a government email address has been used to register on shopping or social media platforms, employees should replace it with a personal email address.

4. Change potentially exposed passwords: If a password may have been compromised, employees should change it using a trusted, secure device and follow their department’s prescribed incident-response procedures.

5. Check for possible data exposure: The advisory suggests using the Have I Been Pwned website to check whether an email address appears in known data breaches. Such a check cannot guarantee that an account is secure or establish that every possible breach has been detected.

Activities Government Employees Must Avoid

Rajasthan Police has advised employees not to use official email IDs to create accounts on dating, gaming, shopping, cab-booking or loan applications.

The advisory further cautions against:

• Reusing government email passwords for personal accounts.
• Using official email addresses as recovery accounts for private services.
• Forwarding government files or official correspondence to personal email accounts or personal Google Drive storage.
• Sharing passwords or OTPs with anyone.
• Granting unauthorized third-party applications access to official accounts.

These precautions are intended to reduce the possibility of credential theft, unauthorized data transfers and misuse of government digital infrastructure.

Where to Report a Cybersecurity Incident

Employees who notice suspicious activity involving their official email accounts or suspect credential misuse should immediately notify their departmental IT Helpdesk or the Security Operations Centre (SOC).

For cybercrime complaints, citizens can use the National Cyber Crime Reporting Portal at https://cybercrime.gov.in. The national cybercrime helpline is 1930.

The advisory also lists the following Rajasthan Police cyber helpdesk numbers:

• 9256001930
• 9257510100

Employees should use official departmental channels for immediate account containment and follow the instructions of authorized IT and security personnel.

Cybersecurity Begins With Individual Responsibility

Rajasthan Police’s advisory underlines an important principle of digital security: protecting government infrastructure requires more than technical safeguards. Individual users must also adopt disciplined password practices, recognize suspicious activity and maintain a clear separation between official and personal online activities.

A single compromised password can become an entry point for a wider security incident. Using unique credentials, enabling additional authentication and reporting unusual activity promptly can help reduce that risk.

(SDNA) — Rajasthan News Desk