A wave of false bomb threats led to the evacuation of hundreds of schools across Europe on Wednesday, prompting Italian Prime Minister Giorgia Meloni to convene an emergency cabinet meeting. Some 6,300 schools in Italy received emails, and a number of buildings were evacuated as a precaution, while at least 1,000 schools in Scotland and more than 300 in Northern Ireland also received similar threats. Officials suspect the threats may be part of a broader pattern of hybrid warfare targeting European countries.
Italian Education Minister Giuseppe Valditara said the threats were probably a “cyber-attack, not a genuine risk”, and that there was a clear strategy behind the rash of hoaxes in Italy and elsewhere in Europe. In a Facebook post, Meloni said the reports appeared to be “part of a strategy aimed at causing alarm and concern”, noting that checks had so far found no evidence of “concrete danger”. The cabinet meeting included cybersecurity experts.
In Scotland, at least 1,000 schools received threatening emails. Police Scotland assessed them as hoaxes and said there was no credible threat. Scottish Education Secretary Mairi McAllan told parliament the situation was “very much in hand”. The assistant chief constable urged parents not to keep children away from school. Northern Ireland's Education Authority confirmed more than 300 schools received a similar message, which it said resembled a bogus threat sent last month.
The threats come amid a wave of incidents that officials and experts suspect may be part of an ongoing hybrid warfare campaign across Europe. In recent weeks, false bomb threats have targeted at least 27 European airlines, alongside hacking operations on supermarket refrigeration systems and coordinated cyberattacks on blood banks. According to Foreign Policy, at least 21 European nations have experienced similar hoaxes or actual cyberattacks. Some security officials suspect Russia could be to blame for the incidents, which they say may target European countries that have armed or financed Ukraine, though Moscow has denied involvement. Separately, French authorities have accused Iran's Islamic Revolutionary Guard Corps of being behind last month’s supermarket refrigeration attack and have summoned Iran's ambassador.
The emails to Italian schools were reportedly signed by a “Mikhail Andropov”, the same purported author of last week’s bomb threats against newsrooms in Bulgaria and Ireland. The BBC reported that emails to Scottish schools also referenced Andropov, described as leader of a “Red Owl” project. One Milan headteacher, Massimo Nunzio Barrella, said the email “seemed almost comical” and he decided not to evacuate his school.
Police in Northern Ireland are conducting urgent enquiries, while Police Scotland is working with law enforcement partners across the UK and internationally to trace the source of the messages. Italian authorities are also investigating.
Analysis
Why This Matters
- The campaign targets public infrastructure, causing fear and disruption, and could affect children's safety and mental health.
- It indicates a potential escalation in hybrid warfare tactics that could undermine trust in institutions and force governments to divert resources.
- The incident may increase pressure on the European Union to impose sanctions on Iran or take stronger action against Russia.
Background
Since early October 2026, Europe has faced a series of hoax bomb threats and cyberattacks affecting airlines, supermarkets, blood banks, and now schools. At least 21 countries have been impacted. Russia has been suspected by some security officials of orchestrating the campaigns in retaliation for European support of Ukraine, but Moscow denies involvement. France recently accused Iran's Islamic Revolutionary Guard Corps of hacking supermarket refrigeration systems and summoned Iran's ambassador. The hoaxes are seen as part of a broader hybrid warfare strategy.
Key Perspectives
Giorgia Meloni, Italian Prime Minister: The threats are part of a strategy to cause alarm; there is no evidence of concrete danger.
Giuseppe Valditara, Italian Education Minister: The incidents are a cyber attack, not a genuine risk, part of a clear strategic pattern.
Mairi McAllan, Scottish Education Secretary: There is no risk to the public; the situation is under control.
Some security officials: Suspect Russia may be behind the campaign as retaliation against European countries arming Ukraine.
France: Accuses Iran's IRGC of the supermarket refrigeration attacks, has summoned Iran's ambassador.
Russia: Denies any involvement in the incidents.
What to Watch
- Whether the European Union imposes new sanctions on Iran following the French accusation.
- If the pattern of hoaxes expands to other critical infrastructure such as hospitals or transport networks.
- The outcome of the cross-border investigation into the source of the emails and potential attribution by authorities.
Checked
12 claims in this story checked against 2 sources: 10 supported.
Show each claim
- SupportedThousands of European schools were hit by hoax bomb threats.Foreign Policy: “Around 6,300 schools across Italy received anonymous bomb threats on Wednesday, forcing hundreds of institutions to evacuate their classrooms. Schools in Scotland, Ireland, and Northern Ireland also received such warnings”
- SupportedOfficials suspect the threats may be part of a hybrid warfare campaign against Europe.Foreign Policy: “False bomb threats once again disrupted thousands of Europeans on Wednesday in what officials and experts suspect may be part of an ongoing campaign of hybrid warfare against the continent.”
- SupportedHundreds of schools across Europe were evacuated on Wednesday because of the false threats.Foreign Policy: “Around 6,300 schools across Italy received anonymous bomb threats on Wednesday, forcing hundreds of institutions to evacuate their classrooms.”
- SupportedAbout 6,300 schools in Italy received the threats.Foreign Policy: “Around 6,300 schools across Italy received anonymous bomb threats on Wednesday”
- SupportedAt least 1,000 schools in Scotland received threatening emails.BBC News: “At least 1,000 schools received the hoax email, though police and the government said there was nothing within them to suggest a credible threat.”
- Partly supportedThe Northern Ireland Education Authority confirmed that more than 300 schools received a similar message.BBC News: “In a separate incident, more than 300 schools in Northern Ireland were sent emails which police said they were treating as a hoax.”
- SupportedMeloni convened an emergency cabinet meeting on Wednesday.Foreign Policy: “The incident prompted Italian Prime Minister Giorgia Meloni to convene an emergency cabinet meeting on Wednesday with cybersecurity experts to discuss next steps.”
- SupportedValditara called the threats probably a “cyber-attack, not a genuine risk”.BBC News: “Some 300 schools across Italy have received bomb threats, according to Education Minister Giuseppe Valditara, who described the incidents as probably a "cyber-attack, not a genuine risk".”
- SupportedMeloni said the reports appeared to be “part of a strategy aimed at causing alarm and concern”.Foreign Policy: ““The reports appear to be part of a strategy aimed at causing alarm and concern, which is currently being investigated in depth,” Meloni posted on social media”
- SupportedMairi McAllan told parliament the situation was “very much in hand”.BBC News: “Government minister Mairi McAllan told parliament the situation was "very much in hand".”
- Partly supportedEmails to Italian schools were reportedly signed by “Mikhail Andropov”.Foreign Policy: “It is unclear who was responsible for Wednesday’s scare, though at least one email to an Italian school was reportedly signed by a “Mikhail Andropov,””
- SupportedMassimo Nunzio Barrella said the email “seemed almost comical”.BBC News: ““The text seemed almost comical,” said Barrella”
