Europe’s New Security Nightmare: Schools, Airlines and Broadcasters Targeted in Escalating Threat Campaign
Bomb Hoaxes Spread Across Europe: Schools Evacuated as Authorities Investigate Suspected Cyber Campaign
From Italy to Britain and Ireland, a wave of threatening messages has triggered emergency inspections, school evacuations and an international investigation. A recurring signature linked to earlier threats against Bulgarian and Irish broadcasters is raising fears of a wider campaign of psychological disruption.
ROME / LONDON / DUBLIN / SOFIA
A threatening email. Thousands of schools. Three European countries. And a disturbing pattern that investigators are struggling to unravel.
Europe’s latest security scare unfolded on Wednesday, November 11, when thousands of educational establishments across Italy, Scotland, Northern Ireland and the Republic of Ireland received bomb-threat messages.
Italy suffered the most significant disruption. Approximately 6,300 schools received the threatening communication, while at least 300 were evacuated as police and bomb-disposal teams carried out precautionary inspections.
The alerts also reached hundreds of schools across the United Kingdom and Ireland. Although authorities classified the messages as non-credible, the scale and international reach of the operation have intensified concerns about a growing campaign of cyber-enabled intimidation targeting European institutions.
Italy: 300 schools evacuated as 6,300 receive threats
The alarm spread across Italy on Wednesday morning, forcing schools to activate emergency procedures and sending parents rushing to collect their children.
Rome, Milan, Naples, Palermo and Bologna were among the cities affected.
The threatening email reportedly warned that an explosive device with a remote detonator had been placed inside school buildings. It also contained an explicit threat against Italian Prime Minister Giorgia Meloni.
The message was reportedly signed by someone identifying himself as Mikhail Andropov, purported leader of the so-called Vilayat of Misoginistan.
Italian police launched inspections, while bomb-disposal specialists examined affected premises.
At Rome’s Mamiani high school, students initially poured into the streets believing the alarm signaled a break. They discovered the reason for their evacuation only after leaving the building.
Despite the disruption, Meloni reassured the public that authorities had found no indication of a concrete danger.
She convened government-level discussions to coordinate the investigation and assess possible connections with previous security incidents.
Britain: Hundreds of schools receive the same warning
The threatening messages crossed the English Channel, reaching schools in Scotland and Northern Ireland.
More than 300 schools in Northern Ireland reported receiving the email, while approximately 470 schools in Scotland were also targeted.
The Police Service of Northern Ireland confirmed that the communication originated outside the United Kingdom and said the threat was being treated as a hoax.
Police Scotland likewise assessed the messages as non-credible, advising schools that evacuation was not necessary solely because of the emails.
Investigators nevertheless continued working with education authorities and international law-enforcement partners to identify the sender.
Ireland: Gardaí reject the threat but investigate
The Republic of Ireland also found itself caught in the expanding operation.
Schools in Dublin, Cork, Carlow, Kilkenny, Cavan, Monaghan and other areas received threatening communications.
An Garda Síochána confirmed that it was investigating a generic message distributed to educational establishments but stressed that its assessment found no credible threat.
Education Minister Hildegarde Naughton coordinated with Justice Minister Jim O’Callaghan, while Gardaí received a substantial number of calls from concerned school communities.
Some institutions took precautionary measures, but national police guidance was clear: schools were not being advised to evacuate.
The Bulgarian connection: A name that keeps returning
Perhaps the most troubling investigative lead lies in the recurring signature attached to earlier threats.
On November 6, Bulgaria’s Nova TV and Ireland’s public broadcaster RTÉ received threatening emails attributed to an individual using the name Mikhail Andropov.
RTÉ temporarily evacuated its Dublin premises. The threatening communication, reportedly titled “Message to the West”, claimed that further disruptions across Europe were coming.
Days later, the same purported identity appeared in the threatening email sent to Italian schools.
The connection has attracted investigators’ attention because it links threats against educational establishments with previous incidents involving European media organizations.
However, the identity of the sender remains unverified. Investigators have not established whether all these messages originated from the same individual or a coordinated network.
From schools to aircraft: Europe’s expanding security problem
The school alerts did not emerge in isolation.
Less than a week earlier, Europe had experienced a major wave of aviation-related bomb hoaxes.
Approximately 30 to 34 commercial flights were affected during the November 5 escalation, prompting emergency landings, diversions and fighter-jet escorts.
An Aer Lingus flight travelling from Dublin to Rome was diverted to a French military airbase. Two Ryanair flights were redirected to Sofia, Bulgaria, while other aircraft faced security inspections across the continent.
Earlier incidents had also affected broadcasters and other European institutions.
Although inspections did not uncover explosives, the repeated disruptions exposed how easily anonymous communications can trigger expensive security operations, interrupt essential services and spread uncertainty across national borders.
Russia, Iran and the shadow of hybrid warfare
The growing pattern has revived concerns about hybrid warfare: operations that combine cyberattacks, disinformation, sabotage, intimidation and psychological pressure to destabilize societies without necessarily triggering conventional military confrontation.
Some European officials have raised suspicions about Russian-linked operations targeting countries supporting Ukraine. Moscow denies responsibility.
Iran has also faced accusations following cyberattacks against French supermarket refrigeration systems. Tehran has rejected the allegations.
Italian reporting has additionally pointed to a potentially compromised account associated with a former student of Taiwan’s Dayeh University as a possible channel through which the school-threat email was distributed.
That lead remains under investigation and does not establish the identity or nationality of the perpetrator.
Italian Defense Minister Guido Crosetto has warned that the objective of such incidents may be to spread fear and anxiety. He has also cautioned that individual provocateurs and attention-seekers cannot automatically be ruled out.
No government or organization has been publicly identified as responsible for the school threats.
The real target may be public confidence
The immediate security assessments offer reassurance: authorities have found no evidence of a concrete bomb threat, and the messages have been classified as hoaxes.
But the consequences extend far beyond the absence of explosives.
Thousands of schools have had to activate emergency procedures. Parents have faced uncertainty about their children’s safety. Teachers and administrators have been forced to respond to threats arriving through ordinary communication systems.
For investigators, the challenge is now to establish who sent the messages, how the communications were distributed and whether the incidents form part of a coordinated international operation.
For European governments, the challenge is broader: protecting schools, transport networks, broadcasters and public institutions against a form of disruption that can cross borders with little more than an email.
The question is no longer simply whether a bomb exists.
It is who is exploiting Europe’s fear, how far the campaign extends, and what institution could be targeted next.
