Hoax Bomb Threats Hit Thousands of Schools Across the UK, Ireland and Italy as Police Say There Is No Credible Danger

Thousands of Schools Across Britain, Ireland and Italy Hit by Hoax Bomb Threats

Threatening emails claiming that bombs had been planted in school buildings were sent to thousands of schools across the United Kingdom, Ireland and Italy on Wednesday, forcing hundreds of Italian schools to evacuate and prompting police forces in three countries to declare the messages a hoax. According to Reuters, about 6,300 schools in Italy received the email, along with around 1,000 schools in Scotland and more than 300 in Northern Ireland. Police in Scotland, Northern Ireland and the Republic of Ireland all said the threats were not credible, that there was no danger to the public, and that schools should stay open.

The emails arrived on Wednesday morning, 11 November, and were sent widely to school distribution lists. In Italy, at least 300 schools were evacuated while police searched buildings, according to the country’s education ministry, and Italian police told CNN that hundreds of schools had been cleared as a precaution. In Scotland, several secondary and primary schools were also evacuated briefly as a precaution, according to The Times, before police confirmed that no evacuation was necessary. Schools in Northern Ireland were advised to remain open, and the Republic of Ireland’s police force, the Garda Síochána, said the message it had seen was not credible and called for no evacuations.

By the end of the day, the picture was clear: no device had been found anywhere, no one had been hurt, and the authorities in every affected country were treating the episode as a coordinated hoax. What remained unresolved was who sent the emails, why schools were chosen, and whether the messages were the work of a single sender, a small group, or part of a wider campaign of disruption that has been hitting European infrastructure for weeks.

Police Scotland said the messages had been “immediately assessed” and were being treated as hoaxes. “Our enquiries have established that there is nothing to suggest that they represent a credible threat or that there is any wider threat to the public,” the force said in a statement quoted by Reuters. Assistant Chief Constable Mark Sutherland, speaking for Police Scotland, said officers understood how distressing messages of this kind could be for pupils, parents, carers and school staff, and the concern they could understandably cause. He said the force’s Cyber and Fraud Unit was carrying out extensive enquiries to establish the source of the messages, and that officers continued to liaise with law enforcement partners across the United Kingdom and internationally.

The scale in Scotland was striking. Police Scotland said around 1,000 Scottish schools had received the threatening email, up from an earlier estimate of 470 as reports continued to come in through the day. According to The Times, schools were targeted in many parts of the country, including the Highlands, Dumfries and Galloway, Inverclyde, West Lothian, Perth and Kinross, and Fife. Edinburgh briefly evacuated schools as a precaution, according to reporting summarised by The Guardian and Al Jazeera, and Dumfries and Galloway sent some children home. Glasgow City Council wrote to parents to say that police had confirmed the message was a hoax and that schools should not be evacuated.

The police message to parents and schools was consistent and unusually direct: there was no requirement to evacuate schools or to keep children away from education on the basis of the emails. That clarity mattered, because the first hours of the episode had been confused. Some schools had already evacuated before the police assessment reached them, and parents arriving at school gates found children standing outside in cold November weather. The Sun reported that pupils at one evacuated Scottish school were given foil blankets to keep warm while they waited outside their classrooms.

In Northern Ireland, the Police Service of Northern Ireland said more than 300 schools had reported receiving the same emailed message, which contained a generalised threat. The force said the email had originated from outside the United Kingdom and was being treated as a hoax. Assistant Chief Constable Anthony McNally said police took incidents of this nature very seriously and understood the concern in the community, in school communities and for students and parents. “Our enquiries are ongoing, however, at this stage we consider the risk to the public as low,” he said. Northern Ireland’s Department of Education advised schools to remain open “unless otherwise advised by the PSNI”, and the region’s Education Authority said its schools had received a message with similarities to a bogus threat sent the previous month, adding that at this stage it had not been made aware of any evidence of any credible threat to schools.

In the Republic of Ireland, the Garda Síochána said it was aware of a “generic communication” sent to a number of schools and educational establishments, that it had assessed the threat as not credible, and that there should be no evacuation. Irish police also noted that there had recently been “increased activity in hoax and non-credible bomb threats”, and advised the public to contact officers if they received one.

Italy Evacuates Hundreds of Schools as Meloni Says There Is No Concrete Danger

Italy bore the largest share of the disruption. About 6,300 schools across the country received the emailed threat, a spokesperson for the Italian public education ministry told CNN on Wednesday, and the ministry said at least 300 schools were evacuated while police searched the buildings. Italian police told CNN that hundreds of schools had been evacuated, and officials later said the incident was a suspected hoax. The evacuation figures counted schools that were cleared as a precaution, not schools where anything suspicious was found, and by Wednesday evening nothing had been discovered.

Prime Minister Giorgia Meloni said checks so far had shown no sign of a concrete danger. Writing on Facebook, she said the threats appeared to be linked to “a strategy aimed at generating alarm and concern”, and said the government was following the reports very closely. A meeting of government ministers was convened to coordinate the response, and investigations were under way. Education Minister Giuseppe Valditara told the La7 television channel that the incident was most likely a cyberattack rather than a genuine threat, and said intelligence services were working to identify those behind it. Defence Minister Guido Crosetto announced that he would report to parliament to discuss the security questions raised by the episode.

Reuters reported that it had seen a copy of the email sent to Italian schools. According to Reuters, the message said: “I have just left a plastic bag containing a powerful, remotely controlled bomb in your building.” The same copy, Reuters reported, also contained a threat aimed at the prime minister herself, and was signed “Mikhail Andropov, leader of the Vilayat of Misoginistan”. The Sun reported that the Italian version of the message read “We have come to annihilate you. We shall carry out a genocide against the Italians”, and said it included the line “We have planted a bomb in the engine of your Prime Minister’s car”. The identity behind the name Mikhail Andropov has not been verified, and no group has been confirmed as responsible.

The name is not new to European authorities. According to The Times, the same name was used to sign letters sent to newsrooms in Ireland and Bulgaria this month claiming responsibility for a wave of hoax threats that disrupted passenger flights across Europe. Al Jazeera reported that the same purported author had claimed responsibility for email bomb threats sent to newsrooms in Ireland and Bulgaria on Friday. The Sun reported that bomb threats under the same alias had been sent on Friday to European television broadcasters, including Ireland’s RTE, the Dublin radio station Newstalk, and Sky. The Sun also reported that a group calling itself the “Red Owl” project had claimed responsibility for the school threats, although that claim has not been independently verified and other reports have described the signature differently.

The Guardian reported, citing the Italian broadcasters Rai and Sky TG24, that the Andropov signature had also been used in several hoax bomb alarms against European flights the previous week. The disruption to aviation is part of the same pattern: Al Jazeera reported that bomb threats this month had forced flights to divert or stay on the ground, and that hackers had also raised the temperatures of refrigerators at supermarkets in Germany, Romania and the United Kingdom. On Tuesday, France summoned Iran’s ambassador over a similar attack on its supermarkets in October, a charge Tehran called baseless. Some European officials suspect Russia of orchestrating the campaign, according to Al Jazeera, something Moscow denies.

A Familiar Pattern: The October Hoax and the Week Before

Wednesday’s emails were not the first time schools in Britain and Ireland had received threats of this kind. On 19 October, a similar hoax was sent to schools in Scotland and Northern Ireland. The Police Service of Northern Ireland said at the time that up to 300 schools had reported receiving the same emailed message, which contained a generalised threat and originated from outside the United Kingdom. Stormont’s education minister, Paul Givan, said the October message had threatened that Sharia law would be brought into the country, that viable devices were hidden in school settings, and that it was signed off “Allahu Akbar”. A number of schools in Northern Ireland closed on the Monday morning, and police said checks had found nothing untoward. Police Scotland said at the time that it was aware of threatening messages sent to a number of schools across Scotland and that these were being treated as a hoax.

The October message and Wednesday’s message differ in their wording and signature, and the authorities have not said the two episodes were sent by the same person. What they share is the method: a single email, sent to a distribution list of schools, written to sound like a credible threat, and designed to force a decision on headteachers within minutes of arrival. The method works because schools cannot ignore a bomb threat, even one that looks implausible. The cost of getting it wrong is unthinkable, so schools evacuate first and wait for the police assessment afterwards.

Italy had also been hit before Wednesday. The Guardian reported that a similar warning the previous week had affected more than 200 schools, including many in Rome. That earlier episode was smaller than Wednesday’s, but it meant that Italian schools and police were already familiar with the pattern when the new emails arrived. The difference on Wednesday was scale: roughly 6,300 schools, according to the education ministry, received the message on the same morning, turning a local nuisance into a national incident that required a meeting of government ministers.

How the Day Unfolded, Hour by Hour

The emails began arriving on Wednesday morning. In Italy, the education ministry’s figure of about 6,300 recipient schools was reported by Reuters, CNN and the BBC, and the ministry said at least 300 schools had been evacuated. In Scotland, the first police estimate was 470 schools, a figure that was later revised upward to around 1,000 as more schools reported receiving the message. In Northern Ireland, the count rose to more than 300 schools through the day. In the Republic of Ireland, police did not publish a number, describing the message only as a “generic communication” sent to a number of educational establishments.

The evacuations followed different patterns in different places, and the differences reveal how much depends on the first minutes after a threat arrives. In Italy, where the emails reached thousands of schools at once, hundreds of schools evacuated and police began searching buildings. In Scotland, several secondaries and primaries evacuated as a precaution, but Police Scotland said the messages had been deemed hoaxes and that there was no need to evacuate. In Northern Ireland, schools were told to stay open. In the Republic of Ireland, no evacuation was called for at all. The same email, in other words, produced four different responses, and the difference came down to how quickly the police assessment reached the schools.

By the afternoon, the official position had converged. Police Scotland, the PSNI and the Garda had all said the threats were not credible. Meloni had said there was no indication of concrete danger. Valditara had described the incident as most likely a cyberattack. The evacuations in Italy had ended without anything being found. The remaining work was investigation: Police Scotland’s Cyber and Fraud Unit was working with law enforcement partners in the United Kingdom and internationally to establish the source of the messages, and Italian intelligence services were working to identify those behind the emails.

Analysis: Why It Matters

The disruption is the point

The most important fact about Wednesday’s emails is also the simplest: there was no bomb. No device was found in any school in any of the four countries affected, and no one was hurt. Yet thousands of schools were disrupted, hundreds were evacuated, parents were frightened, and two governments spent the day responding. That gap between the absence of any physical danger and the scale of the disruption is the whole story, because it shows what a hoax email can achieve at almost no cost to the sender. A single message, sent to a distribution list, can close schools across a continent for a morning. The sender needs no explosives, no network on the ground, and no real capability at all. The threat itself does the work, because the institutions receiving it cannot afford to treat it as a joke.

This is why Meloni’s description of the emails as “a strategy aimed at generating alarm and concern” is worth taking seriously. The aim of a message like this is not to kill anyone. It is to make people afraid, to force schools to evacuate, to dominate a news cycle, and to demonstrate that a sender sitting far away can reach into classrooms in Edinburgh, Belfast, Dublin and Rome at the same time. The Italian education minister’s description of the incident as most likely a cyberattack points in the same direction: the weapon here is not a bomb but an inbox, and the target is not a building but public confidence.

Schools are soft targets for a reason

Schools are chosen for these threats because they are the institutions least able to absorb one. A threat to an office block can be assessed by security staff and a facilities manager. A threat to a school lands on a headteacher who is responsible for hundreds of children, and the decision must be made in minutes, with parents already arriving at the gates. The cost of evacuating is high: lost teaching time, frightened children, parents leaving work, and in November, children standing outside in the cold. The cost of not evacuating, if the threat were real, is unthinkable. That asymmetry is what makes schools such attractive targets for anyone who wants to cause disruption without taking any physical risk.

The pattern also exploits the way schools communicate. School email addresses are often published on websites and shared in directories, and distribution lists make it possible to reach hundreds of schools with a single send. The October hoax and Wednesday’s emails both used that route. The lesson for schools is not that they should ignore threats, which they must never do, but that the first call after a threat arrives should be to the police, and that a fast, authoritative police assessment is the only thing that can stand between a hoax and a day of chaos. On Wednesday, the schools that waited for that assessment stayed open. The schools that evacuated first did so before it arrived.

The attribution trap

The most dangerous part of Wednesday’s story is the temptation to name a culprit before the evidence exists. The signature on the Italian email, “Mikhail Andropov, leader of the Vilayat of Misoginistan”, sounds like a claim of responsibility, but a signature in an email proves nothing about who wrote it. The name has appeared in several different kinds of threat over the past weeks, attached to flight disruptions, newsroom threats and now schools, and the claims attached to it have varied. The Sun reported a different claimed affiliation, a group calling itself the “Red Owl” project. The October school threats carried a different signature and a different message altogether. None of this has been verified, and the authorities in Scotland, Northern Ireland and Italy have all been careful to say only that investigations are continuing.

That caution matters, because the wider context is already politically charged. Al Jazeera reported that some European officials suspect Russia of orchestrating the wider campaign of disruption, which Moscow denies, and France summoned Iran’s ambassador on Tuesday over a supermarket attack, a charge Tehran called baseless. Each of those suspicions may or may not be right, but none of them has been established in connection with Wednesday’s school emails, and treating a suspicion as a fact would do the sender’s work for them. A hoax that is blamed on the wrong country becomes a diplomatic incident as well as a school disruption. The police forces involved have so far resisted that pressure, and their restraint is one of the more encouraging features of the day.

What the response got right

For all the disruption, the official response on Wednesday was fast and unusually coherent. Within hours, police forces in Scotland, Northern Ireland and the Republic of Ireland had each issued the same assessment: the threats were hoaxes, there was no credible danger, and schools should stay open. Meloni said the same thing in Italy, in almost the same words. That consistency matters, because the worst outcome in an episode like this is a vacuum. When the authorities say nothing, rumours fill the gap, parents keep children at home, and schools evacuate out of caution. When the authorities speak quickly and in one voice, the disruption ends.

The response also showed the value of the work done after the October hoax. Schools in Scotland and Northern Ireland had already been through this once, and the police forces involved had already established the channels to reach schools quickly. The PSNI and the Education Authority in Northern Ireland were in contact with schools within hours. Glasgow City Council was able to write to parents with a clear message from the police. The system was not perfect, and some schools still evacuated before the assessment arrived, but it was visibly faster and more coordinated than it would have been a month ago. That is a small, practical form of progress, and it is worth recording.

What still has to be answered

Three questions remain open, and the answers will determine whether Wednesday was an isolated incident or the start of a pattern. The first is who sent the emails. Police Scotland’s Cyber and Fraud Unit is investigating with partners in the United Kingdom and internationally, and Italian intelligence services are working on the same question, but no suspect has been named and no arrest has been reported. The second is whether the school threats, the flight threats, the newsroom threats and the supermarket attacks are the work of the same sender or the same campaign, or whether different actors are copying a method that has been shown to work. The third is what can be done to make schools harder to disrupt in this way, whether through better filtering of bulk emails to school addresses, faster channels between police and schools, or clearer guidance on when a threat should trigger an evacuation and when it should trigger a phone call.

None of those questions has an answer yet, and none of them should be answered by speculation. What can be said now is that Wednesday’s emails caused real disruption without any real danger, that the police response was quick and consistent, and that the investigation is under way in at least four countries. The schools affected will want to know who did this and why. The rest of Europe will want to know whether it is next.

What to Watch Next

1. The investigation: Police Scotland’s Cyber and Fraud Unit is working with law enforcement partners in the United Kingdom and internationally to trace the source of the emails, and Italian intelligence services are working to identify those behind them. Any arrest, or any statement about the origin of the messages, will be the first concrete answer to the question of who sent them.
2. Whether the pattern continues: The October hoax, the flight threats, the newsroom threats and Wednesday’s school emails form a sequence. If further threats arrive in the coming days, the question will be whether they carry the same signature and the same method.
3. The Italian parliamentary report: Defence Minister Guido Crosetto has said he will report to parliament on the security questions raised by the episode. His report may reveal more about what the Italian authorities know about the source of the emails.
4. Guidance for schools: Education authorities in Scotland, Northern Ireland and Italy may issue new guidance on handling emailed threats, and on how quickly schools should expect a police assessment. Any change will affect how the next threat is handled.
5. The wider disruption campaign: Al Jazeera reported that the school threats were the latest in a series of incidents targeting infrastructure across Europe, including flights and supermarkets. Whether European governments treat these incidents as a single campaign, and what they do about it, will shape the response.
6. Attribution: Some European officials suspect Russia of orchestrating the wider campaign, which Moscow denies, and France has already summoned Iran’s ambassador over a supermarket attack. Any official attribution of Wednesday’s emails would carry diplomatic consequences, and the authorities have so far been careful not to make one.

Sources

• Reuters — “Hoax bomb alerts sent to schools in Italy, UK and Ireland in latest disruption”
• Reuters — “Threats sent to UK and Irish schools dismissed as hoax”
• CNN — “Suspected bomb threat hoaxes prompt evacuation of Italian schools, alarm in UK and Ireland”
• The Times — “Schools in Scotland, Northern Ireland and Italy evacuated after ‘bomb threats'”
• Dondoo, citing The Guardian and Al Jazeera — “Hoax bomb emails hit thousands of schools in Italy, Scotland and Northern Ireland”
• Press Association — “Threatening messages to schools not credible and no risk to public, say police”