The incident, which occurred on Wednesday, involved identical emails sent to educational institutions in Italy, Scotland, and Northern Ireland. Italian Education Minister Giuseppe Valditara confirmed to La7 TV that at least 300 schools were affected, noting that the number could rise. While the immediate physical risk was assessed as non-existent, the operational impact was significant. The Italian government convened a meeting of ministers and security chiefs to address the situation. Prime Minister Giorgia Meloni stated on social media that based on checks carried out, no element suggested concrete danger, describing the reports as linked to a “strategy aimed at generating alarm and concern.”
The threat emails themselves contained specific, albeit bizarre, details. According to Italian media reports, the messages purported to be from a “Mikhail Andropov, leader of the Vilayat of Misoginistan.” The text claimed a “powerful explosive with remote detonation” had been left in a plastic bag inside the buildings. However, both Italian and British authorities quickly classified these as hoaxes. In Northern Ireland, the Education Authority advised schools to remain open, stating that the Police Service of Northern Ireland (PSNI) did not regard the messages as a credible threat. PSNI noted similarities to a bogus threat sent the previous month. Similarly, Police Scotland treated the alerts as hoaxes, with their cyber and fraud unit working to establish the source in liaison with international law enforcement.
Defense analysts and officials are increasingly viewing this incident through the lens of hybrid warfare—a strategy that blends conventional military action with cyberattacks, disinformation, and economic coercion to destabilize societies without triggering a direct military response. Minister Valditara explicitly stated, “It is clear that there is a strategy at play,” adding that while it is difficult to identify the perpetrators immediately, intelligence services are working to do so. He characterized the event as a cyberattack rather than a genuine kinetic threat, emphasizing that the content of the emails made concrete risk “virtually nonexistent.”
This school evacuation follows a series of disruptive incidents across Europe in recent weeks. In October, a cyberattack swept hundreds of supermarkets in France, and more recently, hackers altered the temperature settings of refrigeration systems in supermarkets across Germany, Romania, and the UK, an apparent attempt to spoil food supplies. Additionally, flights across Europe have been diverted, grounded, or escorted by fighter jets in response to a wave of bomb threats. Italian Foreign Minister Antonio Tajani also reported being targeted by “cyber criminals” who shared his personal data online, a move he linked to Italy’s support for Ukraine.
The logistical and psychological constraints of such hybrid attacks are becoming a central concern for European security institutions. Unlike traditional military threats, which are met with defensive force, these incidents exploit the fragility of civilian infrastructure and public trust. The “Mikhail Andropov” signature, referencing a former Soviet KGB chief, suggests an attempt to frame the attacks as state-sponsored or ideologically motivated, even if the technical origin remains unverified. Antonello Giannelli, president of the ANP association of Italian school heads, noted that the threats were “clearly fake” but highlighted how “irresponsibility, when combined with the extraordinary communicative power of the tools we have today, can cause damage and disruption on a large scale.”
The human consequences of these disruptions are tangible, even if the physical danger is low. While some students, like those at Brera school in Milan, reacted with relief at the early dismissal, others, such as 16-year-old Angelica, reported panic after being told it was not a drill. The rapid evacuation meant that many students left belongings behind, unable to recover them before police checks were completed. This friction between the urgency of security protocols and the reality of a hoax underscores the operational burden placed on local law enforcement and school administrators.
As investigations continue, the focus remains on identifying the source of the messages. Police Scotland’s cyber unit is coordinating with UK and international partners to trace the origin. The incident serves as a stark reminder of the evolving nature of security threats in Europe, where the battlefield has expanded from physical borders to digital networks and civilian institutions. The next confirmed development will likely involve the results of the Italian government’s security meeting and any subsequent intelligence assessments regarding the broader pattern of hybrid threats targeting European infrastructure.
