On November 11, an anonymous email prompted the evacuation of over 300 schools across Italy. Although no explosives were found, the disruption highlights ongoing security concerns in Europe, where officials are investigating a series of threats and cyberattacks that some speculate could indicate coordinated hybrid warfare.
The warning reached approximately 6,300 Italian schools, alongside similar messages in Scotland, Northern Ireland, and the Republic of Ireland. This latest wave of threats follows earlier incidents affecting nearly 30 European flights on November 5, which resulted in diversions and heightened security measures, including fighter-jet escorts. All reported incidents concluded without the discovery of any bombs.
Daniele Garofalo, an intelligence expert, cautioned that the mass distribution of threats does not necessarily imply state involvement. He stated that establishing a coherent campaign would require evidence linking the senders, their digital networks, methods, and goals. Schools are particularly vulnerable targets, as a single threatening message can lead to widespread evacuations with minimal cost to the sender.
A diplomatic dispute has already emerged over a separate issue involving cyberattacks that disrupted refrigeration systems at several French supermarkets in October. France has attributed these attacks to a unit linked to the Iranian Revolutionary Guard and subsequently summoned Iran’s ambassador to discuss the matter. Iran has denied any involvement. Iranian-Italian analyst Nima Baheli has expressed skepticism about the conclusiveness of the evidence, suggesting that attackers can deliberately leave misleading digital traces.
Russia has also been implicated, as some of the emails associated with the school threats bore a Russian-sounding signature. However, investigators have yet to establish any definitive connections to state actors, and experts warn against equating claimed identities with verified culpability. Baheli also pointed out the potential for domestic actors or false-flag operations, although these views remain unconfirmed by investigators. Italy’s interior minister has even floated the idea of copycat behavior explaining some of these incidents.
The increasing frequency of these threats presents significant challenges for European authorities, who must find a balance between public safety and preventing disruptions to daily life, such as operations in schools, aviation, and commerce. Furthermore, while the European Union can coordinate countermeasures effectively, NATO’s collective defense protocols do not automatically cover threats categorized as false alarms.
The ongoing investigation continues as authorities seek to identify those behind the threats, underscoring the significant impact of anonymous warnings that can provoke extensive, costly public safety responses.
