Following allegations that a widely circulated “guess paper” contained 120 questions matching the actual NEET UG 2026 exam, the Rajasthan Special Operations Group traced the trail to identify the alleged source of the leak. The medical entrance examination, conducted on May 3, was canceled on Tuesday.
A senior SOG official said that once authorities received information about the suspected leak, senior officers were immediately sent to Sikar. At the same time, the Central Bureau of Investigation also began its probe, with major coaching centers in Rajasthan emerging as key focus areas.
According to officials familiar with the investigation, teams led by additional director general of police Vishal Bansal, inspector general Ajay Pal Lamba, and additional superintendent of police Prakash Sharma reached Sikar while nearly 150 police personnel were deployed to track the circulation of the leaked material through WhatsApp.
Investigators said they managed to identify the first person who allegedly received the handwritten copy of the “guess paper,” though tracing him within a few days proved challenging. Police became aware of the suspected malpractice on May 7, the same day the National Testing Agency was informed.
The individual, identified as Shubham Khairnar, was detained in Nashik on May 12.
How the paper allegedly spread
Officials said Khairnar, a final year Bachelor of Ayurvedic Medicine and Surgery student, allegedly obtained a handwritten set of 120 NEET questions presented as a “guess paper.” He is accused of circulating soft copies through WhatsApp.
Police said the material was first forwarded to a person in Gurugram before spreading to several cities across Rajasthan, Kerala, Uttarakhand, Jammu and Kashmir, and Bihar.
Investigators said the paper had reached the phones of a large number of students by the night before the examination, making it difficult to determine who had accessed it.
How the leak surfaced
Four days after the examination, some students, along with staff members from a coaching institute in Sikar, approached the NTA with concerns about a possible leak. The agency subsequently referred the matter to the Rajasthan Police.
Before the CBI formally took over the investigation, the SOG traced Khairnar and uncovered his alleged links to a suspected gang involved in leaking the original paper. Officials also tracked intermediaries accused of buying and further circulating the material.
Officials call it a “new type” of leak
Investigators described the method as unlike previous paper leak cases.
An officer involved in the probe said earlier exam leaks usually involved gangs collecting money from candidates, solving the paper separately, and helping students memorize answers in person. In this case, however, the gang allegedly created a handwritten 410-question “guess paper” containing 120 actual questions from the exam and sold it onward before it spread rapidly through social media.
Police said the investigation is still underway to determine whether others besides Khairnar also received physical handwritten copies from the alleged gang.
The SOG has also expanded its probe to coaching centres in Jaipur, Sikar and Kota.
WhatsApp trail and “Private Mafia” group
During the initial phase of the investigation, SOG teams traced the circulation chain to Gurugram, where they identified a person accused of first forwarding the material to students in Sikar through WhatsApp.
Officials said the paper spread rapidly from Sikar and was also circulated through a WhatsApp group named “Private Mafia.” According to investigators, some students reportedly purchased the paper while others received it free through friends or coaching centres.
After tracing the Gurugram connection, investigators tracked Khairnar in Nashik and coordinated with Maharashtra Police for questioning. Officials said the CBI is now preparing to take custody of him as part of the ongoing investigation.
So far, the SOG has questioned more than 20 people in connection with the case.
