European bomb hoax campaign via hijacked university/agency email accounts — schools, airports, newsrooms targeted
Severity: medium · Patch status: no-fix-needed · Since 2026-11-12
A coordinated hoax email campaign sent bomb threats to thousands of schools across Italy, Scotland, Northern Ireland, Ireland and the wider UK, plus ~20 organisations including airports and newsrooms in prior waves. Proofpoint confirmed the threats came from compromised accounts at legitimate institutions — including Taiwan's Da-Yeh University, the Philippines' Department of Education and a Bogotá health agency — allowing messages to pass authentication checks and evade spam filters. Threats were assessed as not credible; no malware or links were included, suggesting disruption/intimidation as the goal. Signatures referenced 'Male State' and 'Mikhail Andropov' but no attribution is confirmed. Investigators face jurisdictional and anonymization challenges; no fix applies beyond account security.
What to do
- Harden institutional email accounts with MFA and monitor for anomalous logins or outbound bulk sends
- Treat threatening mass emails as hoaxes per police guidance but report to national authorities and preserve headers for investigation
- Ensure email authentication (SPF/DKIM/DMARC) and abuse monitoring on webmail infrastructure
- Prepare and rehearse evacuation/communication procedures for threat emails without over-reacting
- Coordinate with law enforcement and CERTs on cross-border evidence requests
Sources
All live incidents on Threat Watch
