Pierluigi Paganini November 12, 2026

Hudson Rock researchers found that two university addresses tied to Italy’s school bomb threats were in infostealer data.

On 11 November, bomb-threat emails hit schools across Europe. ANSA, citing the Education Ministry, reported that about 6,000 Italian schools received them. Some evacuated, others kept teaching after talking to police, so the recipient count tells you nothing about how many buildings emptied.

The emails were signed “Mikhail Andropov” and threatened pupils and school staff. They also mentioned a bomb targeting the prime minister. However, these names and claims came from the sender and do not confirm who was behind the threats. Italian Prime Minister Giorgia Meloni said that searches found no bombs. She described the emails as an attempt to spread fear and chaos, adding that anonymous messages would not change the school calendar.

The same threats were reported outside Italy. Police in Northern Ireland said that more than 300 schools had received the same message, while Police Scotland classified the cases it investigated as hoaxes. In Ireland, The Journal reported threats against schools and newsrooms sent from different email addresses. This means there is no reason to assume that all the messages came from the same person or group.

Hudson Rock now reports that two university addresses tied to the threats appear in its stolen-credential data.

“The bomb-threat emails that disrupted Italian schools on November 11 have a significant credential-exposure connection.” reads the report. “Hudson Rock identified records for both university email addresses highlighted in threat-related material: [email protected] and [email protected].”

One belongs to an Egyptian university, the other to a Taiwanese one. The company says only that the credentials were exposed. It doesn’t claim they sent the emails, and it doesn’t blame any person, group or state.

The Egyptian address shows up in a Vidar infostealer record from 1 October 2021, taken from a Windows 7 machine running Chrome. The export holds 112 saved credentials, 20 of them using the university address, and two of those point to Microsoft sign-in pages. The same password habits spill across services, so one infected computer exposed a lot more than one account.

That record is more than five years old, which proves exposure and little else. It doesn’t show continuous access, an unchanged password or an infection nobody cleaned. The address also appeared in a newspaper photo and a public post, and the legitimate account holder shouldn’t be treated as the author of the threats.

“The saved credentials also show password reuse across services. That broadens the consequences of a single device infection: the same stolen collection can expose several accounts, including a university identity used on unrelated websites.” continues the report. “The age of the record is an important part of the finding. It places documented exposure more than five years before these threats. It does not demonstrate five years of continuous attacker access, an unchanged password, or an unremediated infection.”

The Taiwanese address turned up in AlienTXTBASE, a collection of aggregated infostealer data that Troy Hunt added to Have I Been Pwned in February 2025. Hudson Rock dates the record to more than a year before the threats. An Italian school published the address after receiving the email, and Focus Taiwan reports that Da-Yeh University found an alumnus account sending a large volume of mail, appearing compromised, and suspended it.

An infostealer copies what a device holds: saved passwords, session cookies, tokens, system details and sometimes wallet data. A stolen password may still open an account later, and stolen session tokens can skip MFA. Nothing in the files shows token theft in either case.

There is still no proof that the stolen credentials were used to send the emails. Full email headers, provider message logs and sign-in records would help identify which account or session sent them. Even if an email passes authentication checks, this does not prove that a specific stolen password was used.

Hudson Rock also discusses what Microsoft and the universities could have done to prevent the abuse. Entra ID Protection can compare leaked credentials with password hashes in an organization’s tenant and apply security policies based on risk. However, this requires an Entra ID P2 or Entra Suite license and proper configuration. The report does not explain what Microsoft or the universities knew about the exposed passwords or whether they were still valid.

A proper response must address the compromised account, its active sessions and the affected device. Organizations should block the account, reset its password through a trusted process and check whether the same password was used elsewhere. They should also revoke active sessions and refresh tokens, review app passwords, unauthorized sign-in methods, application permissions and mailbox rules.

The affected device must also be checked and cleaned. Otherwise, malware on the machine could steal the new password as well. Organizations should also introduce phishing-resistant authentication and monitor sign-in activity and outgoing emails. A sudden increase in outgoing messages should always raise a security alert.

A password reset alone isn’t enough, because some applications control their own sessions and token revocation takes time. An outbound filter won’t stop every first message either. Nobody should need a bomb threat to notice a password has been on the market for a year.

“The disruption illustrates why credential exposure deserves attention beyond fraud and data theft.” concludes the report. “An account associated with an ordinary university user can become a means of reaching schools, frightening families, and consuming emergency resources”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, school bomb threats)