> ## Content Index > Fetch the complete content index at: https://www.cyberdelegate.com/llms.txt > Use this file to discover other available public pages before exploring further. # Compromised Institutional Email Accounts Fuel Bomb Threats Across European Schools. - URL: https://www.cyberdelegate.com/compromised-institutional-email-accounts-fuel-bomb-threats-across-european-schools/ - Published: 2026-11-13T08:31:24.000Z - Updated: 2026-11-13T08:31:24.000Z - Description: A wave of bomb-threat hoaxes targeting European schools has been linked to compromised institutional email accounts. The incidents highlight how attackers can exploit trusted communication channels to cause widespread disruption. - Author: The CyberDiplomat - Tags: Cyber Threat, Europe, bomb threat, email hijack, European schools, hoax campaign, cyber disruption, #crawler A wave of bomb-threat hoaxes targeting European schools has been linked to compromised institutional email accounts. The incidents highlight how attackers can exploit trusted communication channels to cause widespread disruption. ## Background and how the hoaxes were delivered On 11 November, a compromised webmail account belonging to Taiwan's Da-Yeh University was used to distribute bomb-threat messages to thousands of schools in Italy, Scotland, Northern Ireland and the Republic of Ireland. The university subsequently suspended the account used to send the emails. A separate threat was reportedly sent to Italian schools on 12 November from an email address associated with the Philippines' Department of Education. Separately, authorities in Bogotá, Colombia, were investigating a potential compromise involving a city health agency from which other hoax emails had reportedly originated. The messages contained no malicious links or attachments, suggesting that the objective was disruption or intimidation rather than malware delivery or credential theft. Because the messages were sent through genuine, compromised email accounts rather than forged sender addresses, they could pass standard email authentication checks and avoid some spam filters. ## Scope of the campaign According to Proofpoint, an earlier wave of threats observed the previous week targeted approximately 20 organisations, primarily in Europe. These included at least a dozen newsrooms and several airports. The subsequent school-related wave reached thousands of Italian schools, prompting evacuations from Milan to Sicily. Around 1,000 Scottish schools also received threatening emails, while hundreds of schools in Northern Ireland reported receiving similar messages. Irish police assessed the threats as not credible and advised that educational institutions did not need to evacuate. Garda Commissioner Justin Kelly said the threats appeared to originate outside Ireland and were intended to sow discord ahead of the European Political Community summit in Dublin. The Irish government also indicated that the earlier incidents were likely part of a coordinated disruption campaign. However, no government has formally attributed the incidents to a specific threat actor. Proofpoint also cautioned that although some aspects could be consistent with a nation-state-aligned actor, there was insufficient evidence to establish such a connection. ## Investigation challenges Law-enforcement agencies face significant challenges in tracing the origins of the messages. First, the use of legitimate but compromised email accounts allows threatening messages to pass authentication checks that might otherwise identify forged sender addresses. Investigators may therefore need access to account login records and other provider-held information to establish who accessed the accounts. Second, the international scope of the incidents complicates evidence collection. The accounts and organisations involved span Taiwan, Colombia, the Philippines and several European countries. Investigators may need to rely on mutual legal assistance requests to obtain evidence across jurisdictions, a process that can be time-consuming. Da-Yeh University responded by suspending the compromised account after identifying its use in the threat campaign. However, the precise method used to gain access to the accounts remains unknown, as does the total number of messages sent and the identity of those responsible. ## Why it matters Even without malicious payloads, bomb-threat hoaxes can cause significant operational disruption. Schools may need to activate emergency procedures, evacuate students and dedicate staff resources to assessing threats. Newsrooms and airports face similar interruptions, potentially affecting public information services and travel operations. The incidents demonstrate how compromised institutional accounts can be exploited to undermine trust in legitimate communication channels. When messages originate from genuine accounts, conventional email authentication mechanisms alone may not be sufficient to distinguish malicious activity from legitimate correspondence. For organisations, the incidents reinforce the importance of securing institutional email accounts, monitoring unusual login activity and detecting abnormal outbound email patterns. They also highlight the need for established procedures to assess threatening communications and coordinate with law-enforcement authorities. Although the threats were assessed as non-credible, the campaign illustrates how relatively simple email-based deception can create disruption across multiple countries without requiring malware deployment or direct attacks against the targeted institutions. ### Sources - [The Record](https://therecord.media/europe-hoax-email-threats?ref=cyberdelegate.com) - [Central News Agency – Taiwan](https://focustaiwan.tw/society/202611120012?ref=cyberdelegate.com) - [Bogotá Mayor's Office](https://bogota.gov.co/mi-ciudad/gestion-publica/2026-11/bogota-pidio-fiscalia-y-policia-investigar-ataques-ciberneticos-2026?ref=cyberdelegate.com) - [Police Scotland](https://www.scotland.police.uk/what-s-happening/news/2026/november/statement-on-threatening-messages-sent-to-schools/?ref=cyberdelegate.com) - [Police Service of Northern Ireland](https://www.psni.police.uk/latest-news/threatening-emails-over-300-schools-being-treated-hoax?ref=cyberdelegate.com) - [Reuters](https://www.reuters.com/world/europe/schools-nireland-sent-threatening-email-authorities-believe-not-credible-2026-11-11/?ref=cyberdelegate.com)