The unravelling of a suspected leak in the National Eligibility-cum-Entrance Test (NEET-UG), 2026, in Rajasthan began with an automated fine print on a WhatsApp message: “Forwarded many times.” When investigators following the trail of a “guess paper” stumbled upon this WhatsApp message, they realised that what they hoped was an isolated leak was much larger in scale.Officials of the Rajasthan Special Operations Group (SOG), which had been investigating the case before the CBI took charge on Tuesday, said that they found a WhatsApp group named ‘Private Mafia’, where the said paper was being circulated and had members who had paid various amounts, beginning from around Rs 5,000, to join the group. However, despite strict “instructions” from the group administrators not to share the paper, it was circulated far and wide.Officials said that preliminary investigation had indicated that the paper may have leaked from Nashik, Maharashtra.Read | ‘Must call their bluff’: Testing body after NEET-UG cancelled over suspected leakNashik police officials said they have picked up a medical student, identified as Shubham Khairnar (30), who allegedly managed to obtain the question paper days before the exam and shared it further.Kishor Kale, Deputy Commissioner of Police, Nashik City, said that Shubham’s questioning indicates that he “got the question paper from one of his associates in Pune”. “He received a physical copy of the question paper and transferred it to others as a soft copy,” Kale said, adding that it is being investigated whether this soft copy was the “guess paper” or the actual question paper.“He was a student of Bachelor of Ayurveda, Medicine and Surgery (BAMS) in Bhopal last year and stays in Nashik with his family. We received information from the Rajasthan SOG early Tuesday morning about taking him into custody. We apprehended him and brought him to the crime branch office. As per the preliminary inquiry, he was also a part of the (paper leak) syndicate. We are now transferring him to the CBI,” Kale said. But he insisted that “rumours of paper leaking from Nashik are baseless” and that “the paper wasn’t printed here.”Read | How a WhatsApp message ‘forwarded many times’ led to NEET UG cancellationKirankumar Chauhan, Deputy Commissioner of Police, Nashik, said, “The accused had changed his appearance by cutting his hair, making identification difficult. However, based on technical analysis and police investigation, the Crime Branch team managed to trace and detain him.” Officials suspect he purchased the paper for Rs 10 lakh and later sold it for Rs 15 lakh.Story continues below this adShubham is alleged to have shared the paper with people in Gurgaon and elsewhere, with copies eventually reaching Rajasthan, Kerala, Bihar, Uttarakhand, Jammu and Kashmir, and possibly other states. Those who received it included students and career counsellors.One paper, many trailsSOG officials also reached Sikar on Tuesday as part of their investigation, putting the spotlight on the district that has recently emerged as an alternative to Kota, especially for NEET coaching.Read | 120 of 410 questions from NEET UG appeared in ‘guess paper’, probe begins in RajasthanSOG officials said their investigation also indicated that an MBBS student from Rajasthan’s Shekhawati, who is studying in Kerala, allegedly shared the paper with their father, who runs a paying-guest accommodation in Shekhawati, before the examination. This was shared further, spreading the leaked paper.Story continues below this adAjay Pal Lamba, the SOG Inspector General, said that more than 150 candidates, their friends and parents have been questioned so far. The SOG has also submitted a list of 150 students and about 70 parents, who allegedly received the paper, to the CBI. Additionally, two dozen key suspects have been handed over to the CBI, Lamba said.He said that the investigation has revealed that the accused allegedly conspired to sell the genuine question paper as “guess papers”. “Questioning several persons has pointed to an organised group. All these suspicious persons are being questioned by the CBI now. It is wrong to say that Rajasthan is the epicentre; it reached the state via other states. Before Rajasthan, it had reached a person near Gurgaon. It did not originate in Rajasthan,” he claimed, adding that so far, there is no link to gangs in Rajasthan that had earlier been linked to other paper leaks in the state.An ignored complaintBefore the messages circulating on WhatsApp blew the lid off the lead, sources said that a whistleblower in Rajasthan had approached the local police but did not get a positive response. He then wrote to the National Testing Agency, which verified the complaint, and the Rajasthan SOG eventually initiated a probe.Sources said that the whistleblower himself is now under scrutiny for allegedly receiving and sharing the question paper, and that he may have complained to avoid arrest once the leak became widespread.Story continues below this adNTA Director General Abhishek Singh on Tuesday said the whistleblower had said he received a WhatsApp message before the exam in which a few questions matched those in the actual examination.Addressing journalists in Jaipur, Vishal Bansal, Additional Director General of Police, SOG, had earlier said that the “guess paper” had over 400 questions, of which around 120 appeared in the actual examination. “And this guess paper was with students’ weeks before the examination, as far back as a month,” he said, adding that it was being shared “as a .pdf file of about 150 pages with over 400 questions.”