Thousands of schools across Italy and UK hit by bomb hoax

For thousands of families across Italy and the United Kingdom, Wednesday began with the sudden, jarring experience of emergency sirens and unexpected evacuations. What appeared to be a synchronized wave of security threats forced parents to abandon work, students to gather in assembly points, and school administrators to manage chaotic classrooms. By the afternoon, however, authorities in Rome, London, Edinburgh, and Belfast confirmed that the disruption was not the result of a genuine security breach, but a widespread, orchestrated campaign of hoax bomb threats.

The scale of the disruption was immense. In Italy alone, approximately 6,300 state schools received a threatening email, a message that reached the vast majority of the country's 7,476 state-run institutions. In Scotland and Northern Ireland, at least 470 and 300 schools were targeted, respectively. While official assessments quickly categorized the threats as non-credible, the psychological and logistical impact was immediate.

For many, the morning was defined by confusion rather than immediate danger. My daughter Dafne started crying because the kids did not understand what was happening, and she was still shaken when I picked her up, said Nensi Bego, parent of a child at the Mazzini middle school in Rome. This is so annoying. It's obvious it's just a hoax that disrupts lessons and disrupts everyone's day.

The primary driver of the panic was a generic email, which reports indicate was signed by a sender identifying as Mikhail Andropov, leader of Vilayat di Misoginistan. While the name carries the weight of a militant persona, Italian officials were quick to downplay the threat. Prime Minister Giorgia Meloni stated that checks conducted so far had not indicated any evidence of concrete danger, characterizing the reports as rather linked to a strategy intended to cause alarm and concern.

Coordinated disruption and the hybrid warfare threat

The breadth of this campaign suggests a level of coordination rarely seen in school-level security incidents. Beyond the schools, the past week has seen a series of similar disruptions across Europe, including bomb hoaxes targeting airlines, newsrooms in Ireland and Bulgaria, and cyberattacks against supermarket infrastructure. For security analysts, this pattern fits the profile of hybrid warfare—a strategy that uses cyberattacks, disinformation, and manufactured crises to destabilize daily life without the need for traditional military engagement.

Italian Education Minister Giuseppe Valditara described the incidents as a probable cyber-attack, not a genuine risk. Italian Defence Minister Guido Crosetto struck a similarly measured tone, noting that Wednesday's threats were part of a clear strategy to spread fear and create anxiety, adding that It is not always the work of foreign countries or hostile entities. There are also attention-seekers and lunatics who, at a time like this, cannot wait to unleash terror in a city or a region.

The technical nature of the messages provided some comfort to those on the front lines. In Milan, headteacher Massimo Nunzio Barrella realized the email was spam immediately when it arrived in his inbox at 08:59, describing the text as almost comical. It was like a message from Martians: 'We have come to annihilate you.' I even had a bit of a laugh, he told the Adnkronos news agency. Another Milan headteacher, Anna Bertato, noted that the sender’s email address had already been classified as spam by a student at a university in Taiwan.

Our advice is that there is no requirement to evacuate schools or keep children away from education based solely on the content of the emails. They have been sent widely to distribution lists across the UK and Northern Ireland and our assessment remains that they do not represent a credible threat.

Police Scotland spokesperson, via The Guardian

Despite these reassurances, the response from local authorities was not uniform. While Scotland’s education secretary Mairi McAllan and Police Scotland advised that there was no need to close schools, some local councils, including Dumfries and Galloway and the city of Edinburgh, opted to proceed with evacuations or send children home as a precaution. In Northern Ireland, officials maintained a similar stance of vigilance, directing schools to remain open unless otherwise advised by the Police Service of Northern Ireland (PSNI).

The difficulty for officials is balancing public safety with the need to prevent the very disruption these hoaxes aim to achieve. Antonello Giannelli, head of the Italian School Principals Association, summarized this struggle: Even though today's threats are clearly hoaxes, we cannot underestimate the consequences of incidents that alarm entire school communities and disrupt the normal conduct of educational activities.

Investigative steps and the path forward

As the immediate panic subsides, the focus has shifted toward identifying the perpetrators. Authorities across multiple jurisdictions are now engaged in a complex digital investigation to trace the origins of the mass-distributed emails. Police Scotland’s cyber and fraud unit is currently liaising with international security bodies to pinpoint the source.

1. European airports and airlines reported a series of bomb hoaxes last week.
2. Newsrooms in Ireland and Bulgaria received email bomb threats on Friday.
3. French officials stated on Tuesday that a wave of cyberattacks targeting supermarket fridges was carried out by Shahid Kaveh, a cyber unit affiliated with the Iranian Revolutionary Guard, which Iran denied.
4. Roughly 6,300 schools in Italy and hundreds more across Scotland and Northern Ireland received bomb threat emails on Wednesday, triggering localized evacuations.

The investigation into the school hoaxes remains ongoing, and the identity of those behind the threats is currently being verified by law enforcement. While some European officials have pointed toward Russia as a potential state-backed actor behind recent disruptions, and Iran was accused in separate supermarket cyberattacks, no formal attribution for Wednesday’s specific school threats has been finalized.

For parents and school staff, the instruction from law enforcement is clear: remain vigilant and report any suspicious activity, while authorities continue their rapid and careful work to verify each report and identify the source of the messages.