IND Rummy Scandal 2026: Government Website Hacks & ED Asset Attachment

1. Background: The Rise of IND Rummy

IND Rummy, also operating under the name Indo Rummy, emerged as one of several real-money gaming platforms targeting Indian users. Unlike traditional rummy apps that rely on legitimate marketing channels, this platform gained notoriety through its association with a large-scale cybercrime operation involving government websites across multiple states.
 

The platform offers real-money games including rummy, betting, and other casino-style games. Its promotion through hacked government domains sets it apart from typical gaming apps and raises serious legal and security concerns.


 

2. The Hacking Operation

Scope of the Breach
 

Cybersecurity investigations have uncovered a massive operation targeting state government websites across India. Hackers inserted unauthorized pages into legitimate government domains to redirect users to IND Rummy and similar platforms.
 

In Rajasthan alone, over 8 lakh government web pages were compromised. The hacking extended to police department websites in Jaipur, Jaipur Rural, Churu, and Udaipur districts. Searches on the Jaipur Police website revealed tens of thousands of results related to betting and rummy keywords.

 

How the Hack Worked
 

Hackers exploited vulnerabilities in government websites to insert fraudulent pages. When users clicked on these links, they were redirected to IND Rummy or other betting platforms. The fraudulent pages often did not open on computers, specifically targeting mobile users. They also manipulated search engine algorithms to achieve better rankings, making the fraudulent pages appear legitimate in search results.

 

Interstate Impact
 

The hacking was not limited to Rajasthan. Government websites in Maharashtra, Telangana, and Mizoram were also compromised. The entire Mizoram government website was reportedly redirecting to gambling sites. The Andaman-Nicobar government website was also found redirecting to IND Rummy. Home Department websites, including those managing arms licenses, were affected.

 

Implications for Users
 

Users clicking on these fraudulent links risk exposure to malware, phishing attacks, and data theft. The unauthorized pages collect user information for the gaming platforms, creating significant privacy and security risks. Users may also unknowingly engage in illegal real-money gaming by following these redirected links.


 

3. Government Response and Enforcement

ED Asset Attachment
 

The Enforcement Directorate (ED) has taken significant action against online rummy operators. Assets worth Rs 1,906 crore were provisionally attached from Gameskraft Technologies, the operator of popular platforms including RummyCulture and RummyPrime.
 

The attached assets included bank accounts, fixed deposits, mutual funds, convertible notes, equity shares, a farmhouse, and multiple residential and commercial properties. This action represents one of the largest enforcement measures against online gaming operators in India.

 

Allegations of Fraud
 

The ED alleged that these companies operated online real-money games using automated systems against users. The use of automated opponents resulted in substantial financial losses to players. Aggressive marketing campaigns, including bonuses, referral incentives, and free tournament entries, lured new users.

 

Restrictive Withdrawal Mechanisms
 

Investigations revealed that operators imposed restrictive withdrawal mechanisms, including withdrawal levies of 5 to 10 percent. This made it difficult for users to access their winnings while ensuring the platform's profitability.

 

User Base Data
 

The platforms had approximately 3 crore users across India, with a significant number located in states where online real-money gaming was already banned, including Telangana, Andhra Pradesh, and Tamil Nadu.


 

4. The PROG Act 2025 and Supreme Court Ruling

Historical Legal Protection
 

For decades, online rummy platforms operated under legal protection. In State of Andhra Pradesh v. K. Satyanarayana (1968), the Supreme Court ruled that rummy is a game of skill. Courts distinguished between games of skill and games of chance, allowing skill-based games to operate freely.

 

The PROG Act 2025
 

The Promotion and Regulation of Online Gaming (PROG) Act, 2025, fundamentally changed this landscape. The Act bans online money games regardless of whether they are based on skill or chance. Any game played for a fee or stake in expectation of winning money falls under the prohibition.

 

Supreme Court Clarification
 

In May 2026, the Supreme Court delivered a landmark ruling in State of Tamil Nadu v. Junglee Games India. The Court held that when games of skill are played with stakes, they constitute gambling. The staking element, not the nature of the game, is the decisive factor.

 

Penalties Under the Law
 

The PROG Act imposes severe penalties for violations. Operating or facilitating online money games carries imprisonment of up to 3 years and significant fines. Advertising such games is also punishable by law. Banks and payment gateways are prohibited from processing transactions related to online money games.

 

Constitutional Challenge
 

A challenge to the PROG Act's constitutional validity is pending before the Karnataka High Court. The petitioner argues that the Act violates constitutional rights, including the right to practice any profession or carry on any business. The outcome could affect the future of online gaming regulation in India.


 

5. Cybercrime Implications

Public Trust Erosion
 

The hacking of government websites undermines public trust in official portals. Citizens accessing legitimate government services may unknowingly be redirected to fraudulent gaming platforms. This creates confusion and exposes users to financial and security risks.

 

Security Vulnerabilities
 

The scale of the breach reveals significant security vulnerabilities in government web infrastructure. Multiple states were affected, suggesting systemic weaknesses that require urgent attention.

 

Search Engine Manipulation
 

Hackers manipulated search engine rankings to make fraudulent pages appear legitimate. Users searching for government services were redirected to gaming platforms, exposing them to potential fraud.

 

Mobile Targeting
 

The fraudulent pages targeted mobile users, who often have less visibility into website URLs and security indicators. This makes mobile users particularly vulnerable to such scams.


 

6. Risks for Users

Security Risks
 

Users clicking on fraudulent links risk malware infection, data theft, and phishing attacks. Personal and financial information may be compromised.

 

Financial Risks
 

Real-money gaming platforms are designed to generate revenue from player losses. Users risk losing significant amounts of money, as evidenced by the ED's findings of substantial financial losses to players.

 

Legal Risks
 

Under the PROG Act 2025, engaging with online money games carries legal risks. Users could face exposure to penalties under the new law.

 

No Consumer Protection
 

Unregulated platforms offer no consumer protection. Users have limited recourse in case of disputes, non-payment, or fraud.


 

7. Alternatives to Consider

For Entertainment-Only Rummy
 

Several apps on official stores offer rummy for entertainment purposes only, without real-money transactions. These apps explicitly state they use virtual coins and do not involve deposits or withdrawals.

 

For Traditional Card Games
 

Physical card games remain the safest way to enjoy rummy without financial or legal risks. Family and social gatherings offer a secure environment for playing.

 

For Online Income
 

Legitimate online earning options include freelancing, content creation, online tutoring, and e-commerce. These require skill development but offer sustainable income without regulatory risks.