Hudson Rock Finds School Threat Email Accounts in Stolen Data

Hudson Rock researchers found that two university addresses linked to Italy’s school bomb threats appeared in infostealer data. On 11 November 2026, bomb-threat emails targeted schools across Europe, with about 6,000 Italian schools reportedly receiving them. Italian authorities said searches found no bombs and described the emails as an attempt to spread fear; several schools evacuated or kept teaching after police inquiries.

The same threats were observed outside Italy, with Northern Ireland reporting more than 300 affected schools and Police Scotland classifying investigated cases as hoaxes. In Ireland, threats against schools and newsrooms were reported from different email addresses, suggesting no single attacker group.

Hudson Rock subsequently reported that the two university addresses cited in threat-related material appeared in stolen-credential data. One address belonged to an Egyptian university and the other to a Taiwanese institution. The Egyptian record comes from a Vidar infostealer entry dated 1 October 2021, tied to a Windows 7 machine; it lists 112 saved credentials, including two pointing to Microsoft sign-in pages.

The Taiwanese address appears in AlienTXTBASE, added to Have I Been Pwned in February 2025, with a record dating more than a year prior to the threats. The report notes there is no evidence that these credentials were used to send the emails, and cautions that even if credentials are exposed, that does not prove continuous attacker access or that the legitimate accounts authored the threats.

It also outlines potential preventative steps around credential exposure and session management, while stressing that a password reset alone is not sufficient.