A wave of bomb-threat emails sent on November 11 reached about 6,000 Italian schools and more than 300 in Northern Ireland, and also hit schools and newsrooms in Ireland and Scotland. A day later, Hudson Rock reported that two sender addresses linked to the threats appear in stolen-credential data.
What the Emails Said and Who They Reached
The messages were signed “Mikhail Andropov” and threatened pupils and staff. They also mentioned a bomb targeting the Italian prime minister. Some schools evacuated. Italian Prime Minister Giorgia Meloni said searches found no bombs, and Police Scotland classed the cases it handled as hoaxes.
The messages came from multiple sender addresses, which suggests they may not all come from one actor.
Scale Across Italy, Northern Ireland, Ireland and Scotland
Italy was hit hardest, with about 6,000 schools receiving the emails. More than 300 schools in Northern Ireland were affected, and schools and newsrooms in Ireland and Scotland also received them.
Hudson Rock Finds Two Sender Addresses in Infostealer Data
Hudson Rock analyzed the sender addresses and found two university email addresses, one Egyptian and one Taiwanese, connected to the threats in infostealer data. One appears in a Vidar record dated October 1, 2021, which held 112 saved credentials and showed password reuse. The other appears in a record in AlienTXTBASE, a dataset added to Have I Been Pwned in February 2025.
What Hudson Rock Does Not Claim
Hudson Rock says its findings show credential exposure only. It does not claim the holders of the addresses sent the emails, and it does not attribute the campaign to any actor.
Open Questions in the Italian and Irish School Threat Probes
Police searches found no devices, and investigations are continuing. Attribution is unresolved.
The sender-address finding points to a recognizable method: threat emails can be sent from accounts whose credentials were stolen earlier, which would let the real sender hide behind unrelated account holders. The Vidar record is from 2021, and its password reuse means credentials taken years ago could still open accounts if nobody changed them. Hudson Rock’s data does not confirm that this is what happened, but it describes how old infostealer logs can become useful long after the original theft.
The case also illustrates how stolen credentials can feed disruption rather than financial crime. A mass email campaign needs only working accounts, and universities in other countries hold many such accounts. If the senders used compromised addresses, the real origin of the campaign could be harder to trace than a single sender address suggests.
For the schools involved, the effect was immediate: evacuations and searches in several countries, with no devices found. For investigators, the open task is to separate the actor behind the messages from the account holders whose credentials appear in the leaked data.
Credential Exposure as a Signal, Not Attribution
The Vidar record is the more detailed of the two findings. It holds 112 saved credentials and shows password reuse, a combination that tends to leave an account usable across services long after the theft. The second address appears in AlienTXTBASE, a dataset added to Have I Been Pwned in February 2025, which means it was circulating in public breach lists well before November.
Why the Multiple Sender Addresses Matter
Investigators looking at the case face a mix of signals: one signature name, several sender addresses and no devices found in police searches. Hudson Rock’s decision not to attribute the campaign fits that picture, and Italian and Scottish authorities’ classification of the threats as hoaxes keeps the focus on the disruption they caused rather than on any real device.
