The threats that disrupted schools across Europe

Reporting published and updated on November 12 followed a wave of threatening emails sent the previous day. ANSA reported that approximately 6,000 Italian schools received the messages, citing the Education Ministry. Some schools evacuated; others continued lessons after consulting police. The recipient count should not be read as an evacuation count.

The messages claimed to be from “Mikhail Andropov,” included threats against pupils and staff, and referred to an alleged bomb targeting the prime minister. The name and organizational labels in those emails are claims made by the sender, not verified attribution.

Prime Minister Giorgia Meloni addressed the disruption on November 11. She said searches had found no bombs and described an attempt to generate fear and chaos. In a video statement reported by ANSA, she said:

“We will not allow an anonymous email to decide our children’s school calendar.”

Giorgia Meloni, November 11, 2026. Translated from Italian.

The disruption extended beyond Italy. Police in Northern Ireland said more than 300 schools reported the same threatening message. Police Scotland also investigated school threats and assessed them as hoaxes.

In Ireland, The Journal reported threats to schools and newsrooms, including its own. It specifically said different addresses were used for the school and media messages. Hudson Rock’s findings here concern the two addresses examined below; they do not establish a common operator or an infostealer connection for every contemporaneous threat.

Two university accounts with historical credential exposure

The Egyptian account: inside a documented infostealer exposure

A photograph used in la Repubblica’s coverage shows the display name “Mosaad Khalifa” and the beginning of a matching email address above the threatening text. The annotated reproduction below identifies the full reported address as [email protected].

A public post on X also identified that address. An apparent sender address does not establish the identity of the person operating the account, and the legitimate account holder should not be treated as the author of the threats.

Searching that address in Hudson Rock’s data produced a match to a computer classified in Cavalier as infected with Vidar. The underlying system-information file is dated October 1, 2021.

The accompanying browser-password export contains 112 credential records. Twenty use the university email address, including two saved against Microsoft authentication pages. The export identifies Google Chrome as the source browser.

Recorded infection date

October 1, 2021, in the underlying system-information file.

Malware classification

Vidar, as identified in Hudson Rock’s Cavalier profile.

Recorded environment

Windows 7 Ultimate, 64-bit; Google Chrome credential export.

Microsoft entries

login.microsoftonline.com/common/oauth2/authorize
ccs.login.microsoftonline.com/ccs/common/oauth2/authorize

Additional context

System and hardware details, running processes, installed software, and credentials for multiple other services.

The saved credentials also show password reuse across services. That broadens the consequences of a single device infection: the same stolen collection can expose several accounts, including a university identity used on unrelated websites.

The age of the record is an important part of the finding. It places documented exposure more than five years before these threats. It does not demonstrate five years of continuous attacker access, an unchanged password, or an unremediated infection.

What an infostealer takes from a computer

An infostealer is malware designed to collect sensitive information from a device and send it to an attacker. Depending on the malware and its configuration, the collection can include browser-saved usernames and passwords, session cookies and authentication tokens, system details, and selected files or cryptocurrency-wallet data. Microsoft’s research describes these capabilities across multiple infostealer families.

The Egyptian record makes the process tangible: it combines a description of the computer with passwords stored for services used on it. The Microsoft URLs identify where the browser associated those credentials with a sign-in page. They document exposure of credentials on the endpoint; they do not identify the eventual email-sending system or prove a breach of Microsoft’s infrastructure.

If a stolen password remains valid and the account’s controls permit access, someone holding it may be able to sign in later. Session-token theft can create a different route: Microsoft explains that replayed tokens can provide access after the legitimate user has already completed MFA. The files reviewed here do not establish token theft or an MFA bypass in either account.

This is why an infection on a computer used for ordinary work can have consequences far beyond that device. A stolen institutional identity can become a vehicle for impersonation, fraud, or disruptive messages to thousands of recipients.

The Taiwanese account: credentials exposed more than a year earlier

The threat connection for [email protected] is independently documented. IIS G. A. Remondini, an Italian school that received the message, published the address in its own account of the incident.

Focus Taiwan reported on November 12 that Da-Yeh University’s initial investigation found an alumnus account had sent a large volume of email and appeared to have been compromised. The university suspended it, while the cause and the identity of the actual sender remained under investigation.

Hudson Rock found the address in AlienTXTBASE, also known as ALIEN TXTBASE. The matching URL–login–password entry pairs the university address with a Microsoft authentication URL and an exposed password. Hudson Rock assesses this entry as originating from infostealer activity.

The collection’s history is well established: Troy Hunt publicly documented its ingestion into Have I Been Pwned in February 2025. For the specific Taiwanese credential material examined here, Hudson Rock places its age at more than a year before the November 2026 threats.

The university’s later suspension addresses the account’s apparent misuse. The broader prevention opportunity was earlier: identifying the exposed credentials and securing access before abnormal bulk sending began. The age of the data makes timely use of exposure intelligence central to this case.

The missing link: from stolen credentials to the sending session

The next investigative step is to connect the exposed accounts to the November sending activity. Original emails with full headers can help distinguish an authenticated delivery path from a forged sender or a forwarded message. Provider message traces, sign-in events, and audit records can establish which identity, application, or session submitted the mail. Even successful email-authentication checks do not, on their own, establish that a particular stolen password was used.

Could Microsoft and the universities have interrupted the abuse?

Verified, unresolved credential theft should trigger an account-security response before further abuse occurs. For identities using Microsoft authentication, Microsoft and the institutions administering those accounts have opportunities to interrupt the chain. The Taiwanese record’s age highlights the time potentially available for that response. Timely action could close a stolen-password access route and help detect subsequent misuse.

Microsoft already documents leaked-credential detection in Entra ID Protection. Its service compares discovered credential material with a tenant’s current password hashes and raises a detection when it confirms a match. A historical credential record appearing in Hudson Rock’s holdings does not establish that Microsoft ingested it, that the password still matched, or that an alert was raised.

Microsoft also supports risk-based access policies that can require stronger authentication or a secure password reset. The leaked-credential detection and the automated policies are distinct capabilities: sign-in and user-risk policies require the relevant Entra ID P2 or Entra Suite licensing and configuration.

A meaningful response to a verified exposure should cover the account, its sessions, and the device:

1. Contain access and replace exposed credentials. Block a compromised account while investigating where appropriate, reset its password through a trusted recovery process, and review any reused credentials.
2. Remove remaining access. Revoke sign-in sessions and refresh tokens, review app passwords, and remove unauthorized authentication methods, application consent, and mailbox rules. These actions are part of Microsoft’s compromised-account guidance.
3. Remediate the endpoint and strengthen authentication. An infected device can steal replacement secrets. Microsoft’s response guidance includes investigating and remediating affected devices alongside account recovery. Stronger, preferably phishing-resistant authentication helps reduce future password-based abuse.
4. Scrutinize subsequent sign-ins and outgoing mail. New access patterns and sudden bulk sending deserve prompt investigation. Where mail is hosted in Microsoft’s cloud, its outbound protections include sending restrictions and alerts for suspicious sending patterns.

A password reset alone is not a complete containment plan. Microsoft notes that revocation timing depends on token and application behavior, and some applications control their own sessions. Nor can an outbound filter be assumed to stop every threatening message before the first delivery.

The prevention question is whether actionable exposure intelligence reached the right controls early enough, and whether the affected organizations acted on it. The evidence reviewed here does not establish what Microsoft or either university knew before the threats, which protections were configured, or whether the captured passwords remained valid.

Once a provider or institution receives verified evidence of unresolved credential theft, it should investigate promptly, contain affected access, and monitor for abuse. Exposure intelligence becomes protective when it leads to those actions.