Hudson Rock ties school bomb threats to stolen university e-mails

Hudson Rock tied bomb-threat e-mails against about 6,000 Italian schools on Nov. 11, 2026, to two university addresses found in stolen-credential data, and the messages threatened pupils and school staff while carrying the signature Mikhail Andropov.

Some Italian schools evacuated while others kept teaching after talking to police. The messages mentioned a bomb targeting the prime minister. Prime Minister Giorgia Meloni said searches found no bombs and that the anonymous messages would not alter the school calendar, calling them an effort to spread fear and chaos.

A separate e-mail that threatened genocide and claimed explosives were planted in schools reached thousands of Italian state schools on Nov. 11, 2026, and evacuations ran from Milan to Sicily. Similar messages also went to hundreds of schools across Scotland, Northern Ireland and Ireland. Police in Northern Ireland said more than 300 schools received the same message.

Mark Sutherland said Police Scotland saw about a thousand Scottish schools receive a threatening email also sent to other UK schools, and that enquiries found nothing suggesting a credible threat or wider threat to the public. Police Scotland classified the cases it investigated as hoaxes. An Garda Síochána called the school threats not credible and said schools should not evacuate. Threats against schools and newsrooms in Ireland were sent from different email addresses.

Hudson Rock located records tied to the two university e-mail addresses named in the threat material. One address belongs to an Egyptian university and the other to a Taiwanese university. Hudson Rock says the credentials were exposed but does not claim they sent the e-mails or blame any person, group or state, and it says the legitimate account holder should not be treated as the author of the threats.

A Vidar infostealer record from Oct. 1, 2021 contains the Egyptian address. Infostealers, malware that steals data from infected devices, copy saved passwords and session cookies along with tokens, system details and sometimes wallet data. The infected device ran Windows 7 and Chrome, and the export held 112 saved credentials, 20 of which used the university address and two of which pointed to Microsoft sign-in pages. A password stolen earlier may still grant account access, and stolen session tokens can bypass multifactor authentication.

The record dates to Oct. 1, 2021, and its age proves exposure but not continuous access, an unchanged password or an unremediated infection. A newspaper photo and a public post also contained the Egyptian address. AlienTXTBASE holds the Taiwanese address, which reached Have I Been Pwned through Troy Hunt in February 2025, and Hudson Rock dates that record to more than a year before the threats. An Italian school published the Taiwanese address after receiving the threat e-mail.

Taiwan’s Da-Yeh University suspended an account used to send the Wednesday e-mails, according to its Central News Agency. Focus Taiwan reported that the university identified a compromised graduate account sending many e-mails and suspended it.

Hoaxers used hijacked accounts at trusted institutions, so their messages passed authentication checks and bypassed spam filters. Criminals and state-sponsored hackers widely trade and exploit stolen credentials. On Nov. 5, 2026, Proofpoint said all the threats it examined came from compromised accounts, not forged addresses. Proofpoint also saw threats against roughly 20 organizations, mostly in Europe, with at least a dozen newsrooms and several airports among them.

“suggesting the objective was disruption or intimidation rather than malware delivery or credential theft,” said Mark Kelly, a staff threat researcher at Proofpoint. The messages contained no malicious links or attachments, and senders claimed access to compromised computer systems. One e-mail to newsrooms had the sender profess to lead the same group responsible for flight threats, and that message said the group experimented with multithreading to send e-mails and accessed compromised devices, servers and accounts in Europe and elsewhere.

Authorities have not linked the hoaxes to any particular actor, and whether the threat waves form one campaign or inspire copycats remains unknown. On Nov. 5, 2026, the Irish government said it seems likely a coordinated campaign of disruption is behind the hoaxes. Proofpoint stated that some aspects might match an actor aligned with a nation-state, though it said there was not enough evidence to reach that conclusion. Garda Commissioner Justin Kelly said police believed the threats came from outside Ireland and aimed to sow discord at the Dublin summit.

Messages to newsrooms and schools carried the signature Mikhail Andropov, and flight-targeting e-mails carried the signature fighters of the Male State, which Russian authorities ban as an anti-feminist movement. The founder of fighters of the Male State denied involvement, and neither signature establishes who sent the messages to any evidentiary standard.

Abnormal Security found a hoax threat on a Lithuanian domain that came from a seemingly legitimate compromised account. On Nov. 12, 2026, a threat to Italian schools came from an address tied to the Philippines’ Department of Education, and the department gave no immediate response to a comment request.

The files contain no evidence of token theft in either instance, and no evidence shows the stolen credentials were used to send the threat e-mails. Passing authentication checks does not prove that a particular stolen password sent the e-mail. Investigators could review full e-mail headers and provider message logs along with sign-in records to locate the sending account or session.

Messages sent through genuine webmail accounts largely resolve to e-mail providers’ own services, and login records could hit dead ends if hoaxers used VPNs or proxy networks. The global spread across multiple jurisdictions challenges investigators needing mutual legal assistance requests. Northern Ireland police said officers are carrying out inquiries to establish the source. Their working theory is that the e-mails came from outside the UK.

The disruption shows that exposed credentials matter for more than fraud and data theft. An ordinary university user’s account can become a tool to reach schools, frighten families and consume emergency resources. A password that has been on the market for a year should not require a bomb threat for people to notice it.

Hudson Rock says organizations should block the account and reset its password through a trusted process, then check for reuse elsewhere. They should revoke active sessions and refresh tokens, then check app passwords and review mailbox rules, application permissions and sign-in methods that were not authorized. The affected device must be checked and cleaned because malware could steal a new password.

Organizations should adopt authentication that resists phishing and track login activity together with outgoing e-mail, and any sudden increase in outgoing messages should trigger a security alert, Hudson Rock says. Entra ID Protection lets organizations compare leaked credentials against tenant password hashes and enforce security policies according to risk. Using it requires proper configuration plus an Entra ID P2 license or an Entra Suite license. Resetting a password alone is not enough because some applications manage their own sessions and token revocation takes time, and an outbound filter will not stop every first message.