Thousands of schools across Europe received threatening emails on November 11, prompting evacuations and emergency responses. Cybersecurity researchers have now discovered that two university email addresses associated with the threats had appeared in stolen-credential databases long before the messages were distributed.
Approximately 6,300 schools in Italy received bomb threats, with hundreds evacuated as authorities investigated. Similar messages reached educational institutions in Scotland, Northern Ireland, and the Republic of Ireland. Police subsequently assessed the threats as hoaxes, with no explosives discovered.
The emails purported to come from someone identifying themselves as “Mikhail Andropov” and contained threats against students and school staff. Some also referred to an alleged attack targeting Italian Prime Minister Giorgia Meloni. Authorities have not established the sender’s identity or confirmed the authenticity of the claimed affiliations.
Cybersecurity company Hudson Rock investigated two university email addresses connected to the campaign and found historical records suggesting their login credentials had previously been exposed.
One address belonged to an Egyptian university and appeared in data collected by Vidar infostealer malware on October 1, 2021. The infected computer’s records contained saved passwords, including credentials associated with Microsoft authentication services.
The second address was associated with Taiwan’s Da-Yeh University. Researchers located matching Microsoft credentials in AlienTXTBASE, a collection containing aggregated stolen login information. Hudson Rock assessed the relevant records as originating from infostealer activity more than a year before the threats.
Da-Yeh University subsequently reported unusual bulk email activity and suspended the affected account. However, researchers emphasized that the historical credential exposure does not establish whether the same stolen passwords were used to distribute the threatening messages.
Determining how the accounts were accessed requires authentication logs and email delivery records from the relevant providers. The findings also do not identify who organized the campaign or establish a connection between every threatening message sent across Europe.
The disruption extended beyond Italy. More than 300 schools in Northern Ireland reported receiving threatening emails, while Scottish authorities investigated similar messages and found no indication of a credible threat.
Meloni addressed the incident publicly, confirming that security checks had not uncovered explosives. She described the messages as an attempt to create fear and disrupt normal school activities.
Hudson Rock’s investigation establishes that credentials associated with both examined addresses had been exposed before the incident. Whether those historical records directly enabled the November 11 campaign remains unresolved, and the individuals responsible for sending the threats have not been publicly identified.