Italy's School Bomb Hoaxes Expose Europe's Cheapest Vulnerability

• Around 6,300 Italian state schools received emailed bomb threats this week, followed by about 1,800 more on Thursday. No explosives were found.
• The wave follows hoax threats against schools in Ireland, Northern Ireland and Scotland, and last week's bomb alerts that diverted flights across Europe.
• Rome has not attributed the attacks. Ministers are split on whether it is a coordinated campaign, and the debate is fast becoming one about Europe's exposure to hybrid disruption.

Italy has spent the week evacuating schools over bombs that do not exist, and it still does not know who is behind the threats.

Around 6,300 state schools received identical emailed bomb threats earlier this week. At least 300 were evacuated while police searched buildings. One message claimed a device had also been planted in Prime Minister Giorgia Meloni's car. Nothing was found anywhere. On Thursday, as classes resumed, about 1,800 more schools received a fresh threat. This one was signed "Mikhail Andropov", claimed explosives had been hidden, and demanded Meloni's resignation.

Not just Italy

The Italian wave is the largest so far in a pattern that has spread across Europe. Thousands of schools in Italy and dozens in Ireland, Northern Ireland and Scotland have received threats in what appears to be a deliberate effort to disrupt daily life. The "Andropov" signature had already turned up on hoax threats in Ireland, the UK and Bulgaria in previous weeks.

Last week, similar messages targeted airlines. Commercial flights were diverted and made emergency landings, and fighter jets were scrambled. Denmark and Romania were among the countries hit. Wizz Air's chief executive has called for a coordinated European approach to handling such threats, rather than 27 national responses.

The threats against Rome's airport operator carried a different signature, claiming to come from a movement banned in Russia. Investigators have confirmed no link between the waves.

Hard to trace, easy to repeat

The first batch of school emails came from a hacked account linked to a university in Taiwan. Thursday's messages came from accounts in the Philippines. The sender appears to have worked from the education ministry's list of state schools: private schools, which sit on a separate list, received nothing. Schools in Trentino-Alto Adige and the Aosta Valley, which use their own email domains, were also spared.

Prosecutors are investigating false alarm, interruption of a public service and serious threats, with terrorism as a possible aggravating factor. Tracing the sender means obtaining server logs from Taiwan, a place with which Italy has no formal diplomatic relations.

The government has told schools not to evacuate on the strength of a mass email alone, without concrete evidence of danger. That is the right instinct. Each evacuation is a small win for whoever sent the message.

Who is behind it?

Rome is not saying, and its ministers are not saying the same thing. Interior Minister Matteo Piantedosi called it premature to talk of a coordinated campaign. Defence Minister Guido Crosetto blamed "idiots" and warned that more threats were likely. Meloni said there was no concrete danger and that it was too early to tell whether the flight hoaxes, the school threats and a suspected cyberattack on supermarket refrigeration systems were connected. That attack hit around 20 Italian grocery outlets and stores in roughly ten EU countries.

Beyond Italy, Emmanuel Macron said there was not yet enough evidence to attribute the threats. A European Commission spokesperson called threats against civilians "simply unacceptable". Poland has previously accused Moscow of running a hybrid campaign against Europe, but no government has formally linked this wave to any state.

At home, the threats have turned political. Meloni held two hours of talks with opposition leaders and appealed for national unity. The centre-left Democratic Party refused to offer unconditional support and proposed shifting part of the planned increase in military spending towards cybersecurity.

What This Means

Whoever is sending these emails has found a very cheap way to cause disruption: a mailing list, a few hijacked accounts, and a signature designed to spark speculation. Whether it is a state operation, a criminal outfit or a prankster with a script, the effect is the same. Europe's schools, airports and supply chains are being tested one inbox at a time. The policy question for Brussels and national capitals is whether threat handling stays national, with every country learning the same lessons alone, or becomes a shared European protocol. The Italian government's instruction not to evacuate without hard evidence is a start. Attribution, if it ever comes, will decide how far Europe chooses to go.