On the evening of 10 November 2025, a Hyundai i20 detonated near Red Fort Metro Station. Thirteen people were killed and many more injured. Within days, investigators said the man who drove the car was a doctor who had worked at Al-Falah University’s medical college in Dhauj, Faridabad.
And that the blast was tied to an explosives haul and a network of radicalised professionals operating from inside the campus.
What followed laid bare a catalogue of institutional blind spots: false accreditation claims, opaque finances, centralised hiring controlled from an off-campus office, and the baffling recruitment of staff already flagged as security risks by state agencies.
Multiple investigations by the NIA, ED, EOW and other bodies are now trying to figure out how Al-Falah, established as a private university in 2014 but with roots in a 1997 engineering college, grew into what investigators now call a “safe haven” for a terror cell.
The beginning
Al-Falah began as the Al-Falah School of Engineering and Technology in Dhauj before being elevated to university status under the Haryana Private Universities (Amendment) Act of 2014.
The campus grew rapidly: over 70 acres spread across hostels, labs and a medical college, with a new hospital building inaugurated in January 2025.
Its MBBS programme, launched in 2019, drew heavily from Kashmir, Mewat and minority communities, giving the institution the outward appearance of a steadily rising private university.
But the paperwork told a different story. Recently, NAAC issued a show-cause notice stating that Al-Falah was falsely displaying active ‘A’ accreditations for constituent colleges whose grades had expired years earlier, and ordered their removal.
But the action came after the Red Fort blast.
The accuracy of the university’s advertised credentials now sits at the heart of mounting regulatory and reputational questions.
Room 13, the doctors and the explosives
Inside the campus, the focus of investigators has turned to Room 13 in Building 17 and nearby Room 4. These hostel spaces were repeatedly flagged in seized notebooks and CCTV footage.
Searches in Dhauj and neighbouring Fatehpur Taga led to the recovery of nearly 2,900 kg of explosive and inflammable material between 8 November and 10 November, including ammonium nitrate and large quantities of NPK fertiliser, along with weapons caches linked to individuals associated with Al-Falah. Forensic teams say the explosive composition matched the device used in the Red Fort attack.
Among those named by investigators is Dr Umar (also reported as Umar Un Nabi / Umar Mohammad), identified as the suicide bomber. DNA samples taken from his family matched remains found at the blast site.
Several other medical faculty members and residents, some from Kashmir, others from Uttar Pradesh and Mewat, have been arrested or detained.
Among them is Dr Shaheen Shahid, an MD in Pharmacology, who investigators allege had been tasked with building the women’s wing of Jaish-e-Mohammed under the banner “Jamaat-ul-Momineen”. Her red Brezza, found on the campus after the blast, has become a key piece of the evidence trail.
Delhi Police on Saturday detained two more doctors from Haryana’s Al-Falah University who were known to Nabi, the driver of the car that exploded near the Red Fort, PTI reported.
According to PTI sources, Mohammad and Mustakim were detained from Nuh. Both were allegedly in touch with Dr Muzammil Ganaie, arrested earlier in the wider probe into a “white-collar terror module”, and were close friends of Nabi.
Diaries, encrypted Threema and Signal communications, and financial trails point, police say, to a two-year cycle of planning and logistics operating from within and around the university.
An institutional timeline of how the plot took root
Investigators trace the plot through three distinct phases. The first, between 2019 and 2021, coincided with the launch of the MBBS course, which created vital infrastructure: hostels, labs, clinical access and the day-to-day mobility of medical personnel in a place which just fit right for logistics management and execution of planning, multiple media reports stated.
Prosecutors believe this environment was exploited to recruit and conceal plotters.
The second phase, between 2021 and 2022, centres on a trip to Turkey. Authorities say key accused travelled there in 2021, returned linked to encrypted channels and handlers, and later joined Al-Falah in a staggered sequence. By late 2021, police allege, strategising had moved inside Room 13 and adjacent hostel rooms, away from view.
The final phase, between 2023 and 2025, was the period of active preparation. Diaries and communication logs contain coded entries dated across these years. By September–October 2025, procurement of fertiliser, weapons and vehicles had accelerated, and investigators believe there was a plan to strike multiple Delhi-NCR locations on 6 December 2025.
The arrest of one accused in October, they say, forced a collapse in the timeline and precipitated the premature 10 November blast.
The accountability gap
Two long-standing institutional practices at Al-Falah have drawn particular scrutiny. Recruitment, according to records and staff testimonies, was handled from the trust’s Okhla head office, and not by academic committees on campus.
This opaque system, investigators say, enabled the hiring of a doctor dismissed on security grounds by the Jammu & Kashmir administration into a senior medical role at the university.
The second is funding transparency. The Al-Falah Charitable Trust holds no FCRA (full form) registration and denies foreign funding, calling the university fee-driven. Yet anonymous staff accounts and early leads suggest foreign donors and occasional “fundraisers” from Gulf countries visited the campus, according to multiple media outlets
These claims have prompted the ED to order a forensic audit and mount a multi-agency examination of company records tied to the founder. The trust’s corporate network, which has several companies registered to the same Jamia Nagar address, is also in the spotlight.
The founder’s past and institutional ethos
Behind the institution stands its founder, Jawad Ahmad Siddiqui, who has a documented history in financial litigation.
An FIR filed in 2000 accused him of large-scale cheating and breach of trust; he served time before being released after restitution.
Critics argue his past underscores a culture of blurred corporate edges and weak governance at Al-Falah, a topic now being re-examined as investigators scrutinise land acquisitions, corporate structures and the financing of the university’s swift expansion.
Operational lapses extend beyond people and paperwork. A lab adjacent to the hospital was sealed as investigators checked for diversion of chemicals. Multiple vehicles linked to accused persons sat parked on campus for extended periods without scrutiny.
The campus mosque, where a preacher known to authorities, delivered sermons, appears in the inquiry as a location connected to the storage of explosives. Hafeez Mohammad Ishtiyaq, from whose rented residence near the Al-Falah University complex in Faridabad a massive cache of explosives was recovered. These details have raised questions about security, surveillance and material control in an institution that simultaneously functions as a medical campus.
What investigators say
Agencies say the episode has exposed a “white-collar terror ecosystem” — a network of professionals and academics who allegedly provided cover, logistics and recruitment pathways while acting under foreign direction.
The NIA now leads the criminal probe; the ED and DRI are mapping money flows; NAAC is examining accreditation violations; and other regulators are reviewing licences and approvals.