Three days after the Indian Computer Emergency Response Team (Cert-In) asked a 19-year-old security researcher to tone down his social media posts about unresolved cyber vulnerabilities, the hacker demonstrated another potential security lapse by sending an email from an official gov.in account to the government’s cybersecurity nodal agency, and other government recipients.
Nisarga Adhikary posted a screenshot on X on Monday showing an email sent from a ‘gov.in’ email account to Cert-In’s incident reporting address. He wrote on X that he had found a vulnerability that allowed him to send emails from an official government account. He did not reveal the name of the department concerned.
Adhikary told HT that after he demonstrated the vulnerability, the department took the affected subdomain offline, but its email service was hosted on a separate gov.in subdomain that remained accessible. He claimed the same exploit continued to work against the email service.
Adhikary is currently employed as Open-Source Intelligence (OSINT) and threat intelligence engineer at IIT Kanpur’s technology innovation hub C3iHub
In fresh emails also sent to a top official of the electronics and IT ministry and others on Monday, Adhikary said he has found a fresh batch of over 100-150 critical findings in connection with gov.in and nic.in domains.
“Will MeitY respond to my previous email, or will it also follow CERT-In’s approach of ignoring serious concerns?” Adhikary said in the email reviewed by HT.
{{/usCountry}}“Will MeitY respond to my previous email, or will it also follow CERT-In’s approach of ignoring serious concerns?” Adhikary said in the email reviewed by HT.
{{/usCountry}}Adhikary said he has been sending “very critical zero day reports” over to the Indian Cybercrime Coordination Centre (I4C), home ministry and departments concerned directly.
“I will not cooperate with Cert-In until my concerns are addressed,” he said.
The screenshot shared by Adhikary on X shows the email being sent to Cert-In, with a government email address as the sender. The email itself takes a sarcastic tone, telling Cert-In: “this email is, in fact, coming from a @gov.in account.”
In the email, he sent a link to a song by singer and songwriter Charli XCX ‘White Mercedes’.
Adhikary explained why he opted for the song.
“‘White mercedes’ is basically about a dysfunctional relationship where one side keeps screwing things up, the other keeps taking them back and eventually there’s this feeling of ‘I don’t deserve you’. After months of me repeatedly going back to CERT-In with vulnerability reports despite everything that’s happened between me and Cert-In, it felt hilariously relatable,” he said.
On August 28, Cert-In sent an email to Adhikary asking him to hold off on publicising vulnerabilities while they were being fixed, contending that his posts were “premature” and asked him to dial back public commentary on unresolved vulnerabilities and coordinate disclosure timelines with the agency.
Adhikary, who made headlines earier this year for breaking into CBSE’s online marking portal, refused to back down following the email and called the agency ‘incompetent.’
Adhikary told HT at the time that he had flagged over 200 vulnerabilities to Cert-In since February 2026, mostly involving private companies, but less than 1% have been fixed. He also alleged that vulnerabilities reported in police and law-enforcement infrastructure remained unpatched despite being marked “patched, please retest” by the agency.