Hoax Bomb Threats Sent to 6,300 Schools in Italy as the Same Email Reaches Ireland and the UK

On Wednesday morning, November 11, 2026, emails arrived at schools across Italy carrying the same message: a bomb warning. Around 6,300 schools received one. Within hours, classrooms were emptied, children were moved to safe areas, and parents across the country were dropping whatever they were doing to collect their sons and daughters. By the end of the day, the warnings had been judged a hoax. No danger was found. But the disruption was real, the fear was real, and the pattern behind it was familiar. The same email threat reached schools in Scotland, Northern Ireland and the Republic of Ireland on the same day, and the same purported author had already claimed responsibility for bomb threats sent to newsrooms in Ireland and Bulgaria the previous Friday. Italian officials described the episode as part of a wider campaign of threats and cyberattacks aimed at everyday life in Europe — against supermarkets, blood banks, air traffic and broadcasters. This is the story of the Italy schools bomb threats hoax November 2026 — what happened, who the email named, and what is still unknown.

1. What Happened on Wednesday Morning

1.1 The Scale of the Warnings

The numbers alone explain why Wednesday became a national story in Italy. Around 6,300 schools received bomb warnings by email, according to reporting by Reuters, which cited the scale of the messages as they arrived during the morning. That is not a handful of schools in one city or one region. It was a wave that reached across the country, touching primary schools, middle schools and secondary schools alike, and it forced a response in hundreds of communities at the same time. The warnings did not arrive by phone or by letter. They came as emails, sent to addresses that are public — the ordinary contact addresses schools publish so that parents, suppliers and local authorities can reach them. A national security source told Reuters that this made the operation strikingly simple. “The (school) emails are public. (Sending the bomb alert messages) was as easy as drinking a glass of water,” the source said. That single detail matters more than it first appears. It means the sender did not need to break into any system, steal any list or pay for any secret. The targets were listed in the open, and the tool was an ordinary email account. The scale of the disruption, in other words, came almost free.

1.2 A Morning Interrupted

For the schools that received the messages, there was no time to debate whether the threat was genuine. A bomb warning, even one that later proves false, has to be treated as real until it is cleared. Schools closed swiftly after the warnings arrived, and the ordinary rhythm of a school morning broke apart. Lessons stopped. Children were gathered and moved to safe areas. Parents received messages through school messaging apps telling them what was happening and where to collect their children. “All students have been taken to a safe area and remain under the supervision of teaching staff,” one school in Rome informed parents through a messaging app. That sentence, calm and practical, captures the position every school was in: responsible for hundreds of children, working from a warning it could not verify, and obliged to act as though the worst were possible. The speed of the response was itself part of the story. Within an hour or two of the emails landing, the disruption had spread from inboxes to streets, as parents left work and headed for school gates across Italy.

2. The Evacuations Across Italy

2.1 Rome and the Mazzini School

In Rome, the Mazzini middle school was among those evacuated, and the experience of one family there shows what a hoax warning feels like from the inside. Nensi Bego, the parent of a child at the school, described collecting her daughter Dafne after the evacuation. “My daughter Dafne started crying because the kids did not understand what was happening, and she was still shaken when I picked her up,” Bego said. The detail is small and human, and it is the part of the story that numbers cannot carry. A child who does not understand why her classroom has been emptied, why she is standing outside with her classmates, why her mother has suddenly appeared in the middle of the morning — that confusion is the real product of a hoax like this one. Bego’s own verdict was blunt. “This is so annoying. It’s obvious it’s just a hoax that disrupts lessons and disrupts everyone’s day.” Her frustration points to the strange position the hoax creates. The adults can see, even in the moment, that the threat is probably empty. But they cannot act on that judgement. They must evacuate first and ask questions later, because the cost of being wrong about a real bomb is unthinkable.

2.2 At Least 300 Schools Cleared

At least 300 Italian schools were evacuated after the email bomb alerts, according to the reports of the day, and the true number of buildings cleared may have been higher as checks continued through the afternoon. Each evacuation followed the same basic pattern: children out, buildings checked, parents called, lessons lost. Police and other public bodies monitored the situation through the day, and Prime Minister Giorgia Meloni said the bomb alerts posed no danger. That assessment, delivered while evacuations were still under way, shows the two tracks on which an episode like this runs. On one track, the authorities can see quickly that the threat has the marks of a hoax — a mass email, a strange signature, no specific device, no credible detail. On the other track, every individual school still has to go through the full procedure, because a national assessment is not the same as a cleared building. The gap between those two tracks is where the disruption lives. A hoax that takes seconds to send can take hours to clear, school by school, and the hours are paid for by children, parents and teachers.

3. The Email and Its Strange Signature

3.1 “Mikhail Andropov” and the “Vilayat of Misoginistan”

The email that reached Italian schools carried a signature that was, on its face, absurd. According to a copy of the message seen by Reuters, it was signed “Mikhail Andropov, leader of the Vilayat of Misoginistan.” The name appears to borrow from Yuri Andropov, the former Soviet leader, while the organisation named in the signature — the “Vilayat of Misoginistan” — is not a known group, and the name itself reads as invented, even mocking. That strangeness is itself a clue, though not a conclusive one. A genuine militant group claiming a real attack does not usually sign its threats with a name that sounds made up on the spot. But a hoax designed to frighten does not need a credible signature either; it needs only to be frightening enough, for long enough, to force an evacuation. The signature also matters for another reason. It is the thread that connects Wednesday’s school threats to other recent incidents. The same purported author claimed responsibility for email bomb threats sent on Friday to newsrooms in Ireland and Bulgaria, according to the reporting. If that claim is genuine, then the school emails were not a one-off prank. They were part of a small campaign, carried out by the same hand or the same group, moving from target to target across Europe.

3.2 A Threat Against the Prime Minister

The email did not stop at threatening schools. A copy of the message seen by Reuters also included a threat to target Prime Minister Giorgia Meloni. That addition changes the character of the message. A threat against schools alone could be read as a crude attempt to cause panic. A threat that also names the prime minister reads as something more deliberate — an attempt to attach a political message to the disruption, or at least to make the email harder for the authorities to dismiss. Meloni’s own response was measured. She said the bomb alerts posed no danger and that police and other public bodies were monitoring the situation. The calm in that response was deliberate, and it is the standard response of a government that wants to deny a hoaxer the panic it seeks. But the threat against the prime minister also raises the stakes for the investigation. Threatening a head of government is a serious matter in its own right, and it ensures that the emails will be investigated as more than a school prank, whoever sent them.

4. Ireland and the UK: The Same Threat, a Different Outcome

4.1 The Threat Crosses the Sea

Italy was not the only country to receive the email. Scotland, Northern Ireland and the Republic of Ireland said many of their schools received a similar email threat from abroad on the same day. The wording suggests the same campaign, the same sender, the same mass-mailing method — school email addresses are public in those countries too, and the same list-building trick would work just as easily there. The cross-border reach is one of the most striking features of the episode. A single sender, or a small group, was able to threaten schools in four jurisdictions in a single morning, using nothing more than email. That is a measure of how cheap and how borderless this kind of disruption has become. It also raises an obvious question for investigators: where was the email sent from, and how many more school systems could the same sender reach with the same effort?

4.2 Classed as a Hoax, Classes Continued

In Ireland and the UK, the outcome was very different from Italy’s. The authorities there said the threat was classed as a hoax and that it did not disrupt classes. Schools stayed open. Lessons continued. Parents were not called to collect their children in the middle of the morning. The contrast with Italy is instructive. It shows that the same threat can produce very different results depending on how quickly it is assessed, how the warning is communicated, and what the local procedure requires. In Italy, the scale of the mailing — around 6,300 schools — and the speed with which it arrived may have left individual schools with little choice but to evacuate first. In Ireland and the UK, the authorities appear to have been able to assess the threat and pass that assessment down to schools fast enough to keep the doors open. Neither response was wrong. Both followed the same principle: treat a threat seriously until it is cleared. The difference was in how quickly the clearing happened, and that difference was worth thousands of lost school hours in Italy.

5. A Wider Pattern of Disruption

5.1 Supermarkets, Blood Banks and Broadcasters

The school threats did not arrive in a vacuum. Reuters described them as the latest in a series of threats and cyberattacks around Europe against supermarkets, blood banks, air traffic and broadcasters. That list is worth pausing over, because it describes the soft underbelly of everyday life. None of those targets is a military base or a government ministry. They are the systems ordinary people rely on without thinking: the shop where they buy food, the service that supplies blood to hospitals, the air traffic system that keeps planes moving, the broadcasters that carry the news. Attacking or threatening those systems does not win a war. It creates anxiety, and anxiety is the point. When a supermarket’s refrigerators stop working, when a blood bank is hit, when flights are disrupted, the effect is felt by people who have nothing to do with any conflict. That is why Italian Defence Minister Guido Crosetto described Wednesday’s threats as part of a clear strategy. “To spread fear and create anxiety,” he said, according to the Adnkronos news agency. The phrase is worth remembering, because it frames the school emails not as an isolated prank but as one move in a longer game.

5.2 The Newsroom Threats

The connection to the newsroom threats sharpens that picture further. The same purported author claimed responsibility for email bomb threats sent on Friday to newsrooms in Ireland and Bulgaria. Newsrooms are another soft target: they are public-facing, their email addresses are published, and a threat against them disrupts the very institutions that report on threats like these. The sequence — newsrooms on Friday, schools on Wednesday — suggests a sender working through a list of easy, high-visibility targets, one category at a time. It also suggests that the sender is watching the coverage. A threat against a newsroom guarantees that the newsroom will report on the threat, and a threat against schools guarantees that parents across a country will talk about it. Each incident advertises the next one, and each one costs the sender almost nothing. The pattern is the message: anyone with an email account and a list of public addresses can hold a country’s morning hostage for a few hours.

6. Who Officials Suspect — and What They Will Not Say

6.1 The Russia Question

Some European officials suspect Russia may be behind a campaign of disruption to everyday life in European nations supporting Ukraine after Moscow’s invasion, according to the reporting. The suspicion is not new, and it follows a pattern that European governments have described repeatedly: sabotage, cyberattacks and intimidation aimed at countries that back Kyiv, carried out in ways that are hard to attribute with certainty. Russia denies that, and accuses the West of a smear campaign. The denial is also part of the pattern. The difficulty for investigators is that suspicion is not evidence, and the school emails carry no proof of who sent them. The signature is invented, the email was sent from abroad, and the method — mass-mailing public addresses — could be used by anyone. That ambiguity is itself useful to whoever is behind the campaign, if there is a campaign at all. A threat that cannot be attributed cannot be answered with a sanction or a diplomatic protest. It can only be cleared, school by school, and then waited out until the next one arrives.

6.2 The Iran Question

Iran is another suspect named in the reporting, and the context is a separate and recent confrontation. France summoned Iran’s ambassador on Tuesday after accusing Tehran of a cyberattack that disabled refrigerators in hundreds of supermarkets last week. Iran rejected those accusations as “baseless and hostile”. The supermarket incident is a reminder that the campaign of disruption, if that is what it is, may have more than one author — or that different incidents may have different authors, and that grouping them together may itself be a mistake. Italian Defence Minister Crosetto made that point directly. “It is not always the work of foreign countries or hostile entities,” he said. “There are also attention-seekers and lunatics who, at a time like this, cannot wait to unleash terror in a city or a region.” His warning cuts both ways. It cautions against blaming a foreign government for every hoax, and it acknowledges that the current climate — of war in Ukraine, of tension with Iran, of daily headlines about hybrid warfare — creates an opening for anyone who wants to cause fear. A prankster, a fantasist or a small extremist group can now borrow the credibility of a great-power conflict simply by sending an email.

7. What the Disruption Costs

7.1 The Human Cost

The human cost of Wednesday’s hoax is easy to understate, because nobody was hurt and nothing exploded. But the cost was real, and it fell on the people least able to absorb it. Antonello Giannelli, head of the Italian School Principals Association, said the alerts were upsetting for students, families and school staff. “Even though today’s threats are clearly hoaxes, we cannot underestimate the consequences of incidents that alarm entire school communities and disrupt the normal conduct of educational activities,” he said. His words capture the paradox at the heart of the episode. Everyone involved — principals, teachers, parents, even the children — could see that the threat was probably empty. But nobody could act on that judgement, and the result was a day of fear and confusion for thousands of families. For a child like Dafne, the memory of crying in a schoolyard because she did not understand what was happening will last longer than the news cycle. For parents, the cost was a working day interrupted, a journey across town in the middle of the morning, and the lingering question of what to tell a child who asks whether it will happen again.

7.2 The Cost of Treating Every Threat as Real

There is also a harder, more practical cost, and it is the cost that makes hoaxes like this one so effective. Every bomb threat, real or false, has to be treated as real until it is cleared. That means police time, school staff time, and the time of every parent who leaves work to collect a child. It means lessons lost, exams disrupted, and routines broken. And it means that the next threat will have to be treated the same way, no matter how many hoaxes came before it, because the one time a threat is dismissed could be the time it is real. That is the asymmetry that makes mass hoax threats such a cheap weapon. The sender spends minutes and nothing else. The state spends hours, and thousands of people, clearing up after them. The only defence is to get faster at assessment — to share information between countries quickly enough that a threat classed as a hoax in Dublin in the morning does not force evacuations in Rome in the afternoon — and to keep the public calm enough that the fear does not do the hoaxer’s work for them.

8. What Happens Now

8.1 The Investigation

The investigation into Wednesday’s emails will now follow the usual, slow path of a cyber inquiry. Police and other public bodies are monitoring the situation, and the task will be to trace emails sent from abroad back to their source — through the servers they passed through, the accounts that sent them, and the digital traces that even a careful sender leaves behind. That work takes time, and it often ends without a public answer. The signature on the email is invented, the sender’s location is unknown, and the connection to the newsroom threats in Ireland and Bulgaria is, for now, only a claim made by the sender itself. Investigators will also have to decide whether the school threats and the wider pattern of cyberattacks against supermarkets, blood banks, air traffic and broadcasters are the work of one hand or several. The answer matters, because it decides whether the response is a criminal investigation, a diplomatic confrontation, or both. For now, the only certainty is that the emails exist, that they reached around 6,300 schools in Italy and many more in Ireland and the UK, and that nobody has been arrested or named.

8.2 The Bottom Line

Wednesday’s hoax bomb threats against schools in Italy, Ireland and the UK were, in the end, exactly what the authorities said they were: a hoax. No bomb was found, no one was hurt, and the schools that evacuated returned to normal. But the episode matters precisely because it was a hoax that worked. A single email, sent to public addresses, emptied hundreds of schools in Italy, frightened children, interrupted thousands of working days, and forced a prime minister to reassure the country. It did all of that without a single explosive, without a single break-in, and without the sender ever leaving wherever they were. The coming days will provide the answers to the questions that remain: who sent the emails, whether any state directed or encouraged them, whether the same hand is behind the newsroom threats and the wider campaign of disruption, and whether schools and governments can assess the next threat fast enough to keep the classrooms open. Until those answers come, the lesson of Wednesday is a simple one. In a Europe already on edge, the cheapest way to spread fear is not a bomb. It is an email that says there is one.

Comments

comments