In the aftermath of the cancellation of the NEET UG 2026 exam by the National Testing Agency (NTA) on Tuesday, the Central Bureau of Investigation (CBI) took over the probe to trace the origins of the leak.

As of Wednesday, a 30-year-old man, named Shubham Khairnar, a resident of Nashik, who is a student of the Bachelor of Ayurvedic Medicine and Surgery (BAMS) is at the centre of the scandal. Police allege he purchased the leaked paper from one of his contacts in Pune for Rs 10 lakh, and later sold it to a buyer in Haryana for Rs 15 lakh.

Paper circulated through messaging platforms

Senior officials said that the paper was circulated by means of encrypted messaging platforms, pointing towards a technologically sophisticated network. The CBI sleuths detained Khairnar on Tuesday while he was heading towards a temple. The investigating officials noted that he had altered his appearance by cutting his hair to evade the law. However, the CBI sleuths tracked him down using old photographs and surveillance inputs.

Meanwhile, Khairnar’s father, Madhukar has declined the claims, terming them ‘unfounded.’ He insisted his son is innocent and also called for a fair, as well as a transparent probe.

Leak racket spans across multiple states

Protests regarding NEET UG 2026 paper leak

The paper leak, according to official sources, is said to have originated from Maharashtra, from where it travelled rapidly across state borders. It reached centres in Gurugram, Sikar, Jaipur and parts of Jammu and Kashmir, Bihar and Kerala. During the unfolding investigation, Sikar, a major coaching hub, has emerged as a key node.

As per authorities, the paper had been leaked 45 hours before the commencement of the exam, raising concerns over the integrity of the entire testing process.

How did the leak come to light?

Curtain was raised off the exam breach when a student linked to Sikar, who was studying in Kerala, allegedly shared a PDF file labelled as a ‘guess paper’ with his father. Later, the document raised suspicion when teachers noticed a striking overlap with the actual exam, as 45 out of 108 questions from the Chemistry section, and 90 out of 204 questions from the Biology sections matched.

While attempts to lodge a complaint met resistance at the local level, the case eventually reached the NTA. It then alerted the Intelligence Bureau (IB). Subsequently, Rajasthan’s Special Operations Group (SOG) launched a full-fledged probe.

15 held so far

So far, the SOG has claimed to have arrested 15 persons in connection with the case in Rajasthan, including masterminds named Manish Yadav and Rakesh Mandwaria. The duo is said to have links with a consultancy centre in Sikar.

The investigating personnel are suspecting the involvement of advanced tools like portable scanners, shadow servers and encrypted networks on the messaging app Telegram.