World · Europe · 9 hrs ago
Bomb threats sent to thousands of Italian schools from hijacked accounts
Threatening emails disrupted thousands of schools across Italy over two days, warning of explosives.
The messages were sent from accounts linked to a university in Taiwan and institutions in the Philippines, but that does not prove they were sent from those countries.
Investigators suspect some accounts may have been hacked and misused, though they have not confirmed that all the threats came from one operation.
The emails used the name Mikhail Andropov and included demands for Prime Minister Giorgia Meloni to resign.
Anonymizing tools could make the sender harder to trace by hiding their actual location.
Italian police and prosecutors are investigating the messages and their digital trail, while Taiwan has offered to help.
Thousands of Italian schools received bomb threats on November 11 and 12, disrupting classes and prompting some evacuations.
The emails were sent using accounts linked to universities in Taiwan and Egypt, and an address associated with the Philippines’ Department of Education.
Taiwan’s Da-Yeh University said it suspended the account used to send the threats after it was apparently hacked.
Researchers found two addresses used in the threats in infostealer logs dating back to October 2021 and February 2025, but said this does not prove the attackers used credentials from those breaches.
Investigators have not identified who sent the messages or confirmed that all the threats were part of one operation.
- Who
- The senders are unknown. The emails were signed with the name Mikhail Andropov.
- What
- Bomb threats were emailed to thousands of schools in Italy, with similar messages reported elsewhere in Europe.
- When
- November 11 and 12, 2026.
- Where
- Schools across Italy; similar emails were reported in France, Ireland, Northern Ireland and Scotland.
- Why
- Not stated. Authorities and researchers have described the messages as hoaxes or possible attempts at disruption and intimidation.
This story does not have two clearly opposing sides.
An email address later used in the threats appeared in infostealer logs, according to Hudson Rock.
Another address used in the threats appeared in the AlienTXTBASE infostealer dump, according to Hudson Rock.
Threat emails linked to an account at Taiwan’s Da-Yeh University were sent to Italian schools.
More than 3,000 Italian schools received threats from addresses traced to the Philippines, according to Il Fatto Quotidiano.
- Italian state schools
- 6,300 of 7,476 received threats between November 11 and 12
- Evacuations
- About 390 schools evacuated, according to The Register
- Taiwan account
- Da-Yeh University said it suspended the account used to send the emails
- Philippines-linked messages
- Threats reached more than 3,000 schools on November 12, according to Il Fatto Quotidiano
- Investigation
- Italian Postal Police and Digos are investigating, according to Il Fatto Quotidiano
3 sources
What people are saying
To date, there is no evidence of a concrete danger.
Both findings place credential exposure well before the disruption, creating a substantial window in which exposed access could have been investigated and secured.
These messages were immediately assessed and we are treating them as hoaxes. Our enquiries have established that there is nothing to suggest that they represent a credible threat or that there is any wider threat to the public.
suggesting the objective was disruption or intimidation rather than malware delivery or credential theft