Hoax bomb alerts sent to schools in Italy, UK
and Ireland in latest disruptions
By Yiannis Damellos and Mars Strangelove Jr.
November 11 2026
Europe is dealing with something that goes beyond a succession of bomb scares and isolated cyberattacks. In recent days, schools have been evacuated, passenger aircraft diverted, supermarket refrigeration systems compromised, blood-bank equipment disrupted and broadcasting organisations forced to respond to security threats. The incidents have affected several countries and different sectors of civilian life, creating a picture of insecurity that European governments cannot afford to dismiss.
Someone may be trying to destabilize Europe. The difficulty is establishing who that someone is, whether the incidents are connected and how much of the apparent confusion is deliberate.
The latest episode unfolded on Wednesday, November 11, when approximately 6,300 schools across Italy received bomb-threat emails. More than 300 schools were evacuated, sending parents rushing to collect their children and disrupting lessons across the country. Similar messages reached hundreds of schools in Scotland and Northern Ireland, as well as educational institutions in the Republic of Ireland. Authorities in Britain and Ireland treated the messages as hoaxes and did not order mass evacuations.
The Italian message also threatened Prime Minister Giorgia Meloni. (The threat was signed by someone calling himself Mikhail Andropov, purported leader of the self-styled Vilayat of Misoginistan — an apparently fictitious name combining the historical Ottoman term for a province with a reference to misogyny, literally suggesting a “Province of Misogyny.”). The same name had appeared in threats sent to newsrooms in Ireland and Bulgaria the previous Friday. Italian authorities have found no evidence of an actual explosive device and have not attributed the messages to a government or an established organisation. Meloni said the threats appeared intended to generate alarm, suspicion and chaos.
An entire week of disruption
The school threats did not emerge in isolation. They followed a series of incidents that had already placed European transport, retail and public services under pressure.
On November 3, at least seven passenger flights received bomb threats. Aircraft were searched, security procedures activated and military assistance deployed. A Ryanair flight travelling from Dublin to Rome was escorted by Italian fighter jets before landing safely at Rome's Fiumicino Airport. Another Ryanair service travelling from Dublin to Sofia was also targeted. No explosives were found.
On November 5, the disruption escalated. At least 27 passenger flights across Europe were affected by another wave of bomb hoaxes. The incidents involved airlines and destinations across Ireland, Britain, Spain, Finland, Austria, Poland, Bulgaria, Greece, Portugal, Denmark, Italy, France, Czechia, Romania, Serbia and Germany.
An Aer Lingus flight travelling from Dublin to Rome was diverted to a French military air base at Évreux after being escorted by French aircraft. Austria deployed Eurofighter jets, while Bulgaria sent MiG-29 fighters to escort three Ryanair aircraft. Prague Airport and several arriving flights were also targeted. Warsaw temporarily closed a runway while a flight was checked.
The threats produced diversions, precautionary landings, aircraft inspections and considerable uncertainty for passengers and airlines. No explosives were discovered. Nevertheless, the operational consequences were real, and the repeated use of bomb warnings demonstrated how easily anonymous messages can force expensive security responses across national borders.
The following day, November 6, the threats reached the media. News organisations in Ireland and Bulgaria received emails claiming that explosive devices had been planted inside their buildings. Ireland's public broadcaster RTÉ evacuated its premises, disrupting broadcasting operations. Britain's Sky News also reported receiving a security threat. The messages claimed responsibility for earlier aviation threats, although investigators had not independently established that the same person or organisation was responsible.
The sender promised further attacks, mentioning aircraft, cruise ships, underground stations and trains. Such declarations should be treated as threats rather than evidence of operational capability. But the message demonstrated an intention to exploit the publicity surrounding the incidents and extend the climate of fear.
Supermarkets and blood banks: Attacking everyday life
While airlines and broadcasters were dealing with bomb threats, another form of disruption was affecting essential civilian infrastructure.
On November 2, supermarket refrigeration systems in at least eight European countries were affected by a cyberattack. In Ireland, 13 SuperValu stores were affected, forcing retailers to remove chilled and frozen products from sale. In other European locations, refrigeration temperatures reportedly rose dramatically, in some cases reaching 50 degrees Celsius.
The affected equipment included refrigeration controllers manufactured by Danish company Danfoss and systems associated with Copeland/Dixell. Ireland's National Cyber Security Centre confirmed that controller systems had been compromised.
Online posts attributed to pro-Russian hacking groups NoName057(16) and Z-Pentest Alliance claimed responsibility for a joint attack involving Danfoss. Their responsibility for the supermarket disruptions has not been independently established, and the Kremlin rejected allegations of Russian involvement.
The same day, three regional blood banks in France experienced cyberattacks affecting refrigeration and control systems. French authorities said blood supplies were not affected. That qualification is important, but the targeting of systems responsible for maintaining essential medical supplies illustrates the potential consequences of attacks against civilian infrastructure.
The French government also accused Iran of involvement in the supermarket refrigeration incident and summoned the Iranian ambassador. Tehran rejected the accusations as baseless and hostile. Investigators have yet to establish a publicly demonstrated connection between the French allegations and the wider series of incidents.
The other incidents that cannot be ignored
The current wave also comes against a background of cyberattacks, suspicious incursions and alleged sabotage affecting European security.
Italy's Brenner Base Tunnel project, which will eventually connect Italy and Austria through one of Europe's major transport corridors, disclosed that its overseeing company had been hacked in October. The incident added another infrastructure-related concern to the security picture.
Italian Foreign Minister Antonio Tajani also disclosed that his personal information had appeared on the dark web. He blamed cybercriminals, while Meloni attributed the incident to pro-Russian hackers. The precise circumstances and responsibility should be distinguished from the government's accusation.
Romania has faced a particularly persistent set of security concerns. Russian drones have repeatedly entered or approached its airspace during the war against Ukraine, while Romanian authorities have described cyberattacks, disinformation, suspected sabotage and incidents involving cargo vessels near Romanian waters as elements of a wider hybrid threat.
On November 11, Romania's intelligence service disclosed that the Russian-linked hacking group Turla had carried out a cyberattack against an unnamed Romanian government institution in December 2025. The agency attributed the operation to a group linked to Russia's FSB security service. It said the attackers exploited vulnerabilities in Microsoft operating systems, but the operation was stopped, no sensitive data exfiltration was identified and the affected email service was repaired. This is a separately investigated, earlier attack, not proof that Russia directed the current bomb-threat campaign.
The wider European security picture also includes drone-related disruptions and investigations into suspected Russian sabotage. These incidents form part of the context in which the latest threats are being assessed, although they should not automatically be treated as components of one operation.
Who is behind the disruption?
Not me, says Vladi, but Russia and Iran have emerged as two possible suspects in different investigations; yet the evidence must be considered incident by incident.
Several European governments have accused Moscow of conducting or supporting hybrid operations intended to weaken countries assisting Ukraine. Russia denies these allegations. Iran, meanwhile, has rejected France's accusations concerning the supermarket cyberattack.
The appearance of the same purported sender, Mikhail Andropov, in threats against broadcasters and schools raises questions about whether a single individual, intelligence group or compromised network is responsible for at least some of the bomb hoaxes. It does not establish a Russian connection simply because the name sounds Russian or because the messages refer to extremist organisations.
There are other possibilities. Criminal groups, politically motivated hackers, opportunistic individuals and state-sponsored intermediaries can all exploit the same vulnerabilities. Different actors can also operate simultaneously, producing a cumulative effect that resembles a coordinated campaign without necessarily being directed from a single centre.
This is why European investigators need to establish whether the incidents share technical infrastructure, digital fingerprints, communication channels, financing or operational planning. Identifying the sender of an email is only one part of the investigation. Establishing who is behind the sender is considerably more difficult.
Europe cannot afford to treat each incident separately
The most revealing feature of this sequence is the choice of targets. Schools, airports, airlines, supermarkets, blood banks, broadcasters and transport infrastructure are not military installations. They are the everyday institutions on which European societies depend.
The objective of hybrid disruption, where it is deliberately employed, is not necessarily to destroy these institutions. It can be enough to interrupt their operations, force governments to divert resources, create public anxiety and undermine confidence in the ability of democratic states to protect their populations.
A bomb hoax can empty a school without an explosive device ever existing. A false warning can divert an aircraft and trigger an international security response. A compromised refrigeration system can threaten food supplies. A cyberattack against a blood bank can put essential medical infrastructure under pressure even when supplies remain safe.
Naturally the demand on police, intelligence agencies, cybersecurity specialists and emergency services accumulates. Thus, at considerable economic and psychological cost, Europe must improve intelligence-sharing, protect vulnerable civilian infrastructure, coordinate investigations and establish clear procedures for responding to threats without allowing every anonymous message to paralyse public life. It must also communicate honestly with its citizens, neither exaggerating the dangers nor dismissing incidents simply because no bomb is found.
Someone wants to destabilize Europe — and they are doing a good job disguising themselves. But the real test for European governments is not simply identifying the next threatening email. It is determining whether these incidents form part of a broader strategy, exposing the networks behind them and making European societies more difficult to disrupt.
An entire week of disruption
The school threats did not emerge in isolation. They followed a series of incidents that had already placed European transport, retail and public services under pressure.
On November 3, at least seven passenger flights received bomb threats. Aircraft were searched, security procedures activated and military assistance deployed. A Ryanair flight travelling from Dublin to Rome was escorted by Italian fighter jets before landing safely at Rome's Fiumicino Airport. Another Ryanair service travelling from Dublin to Sofia was also targeted. No explosives were found.
On November 5, the disruption escalated. At least 27 passenger flights across Europe were affected by another wave of bomb hoaxes. The incidents involved airlines and destinations across Ireland, Britain, Spain, Finland, Austria, Poland, Bulgaria, Greece, Portugal, Denmark, Italy, France, Czechia, Romania, Serbia and Germany.
An Aer Lingus flight travelling from Dublin to Rome was diverted to a French military air base at Évreux after being escorted by French aircraft. Austria deployed Eurofighter jets, while Bulgaria sent MiG-29 fighters to escort three Ryanair aircraft. Prague Airport and several arriving flights were also targeted. Warsaw temporarily closed a runway while a flight was checked.
The threats produced diversions, precautionary landings, aircraft inspections and considerable uncertainty for passengers and airlines. No explosives were discovered. Nevertheless, the operational consequences were real, and the repeated use of bomb warnings demonstrated how easily anonymous messages can force expensive security responses across national borders.
The following day, November 6, the threats reached the media. News organisations in Ireland and Bulgaria received emails claiming that explosive devices had been planted inside their buildings. Ireland's public broadcaster RTÉ evacuated its premises, disrupting broadcasting operations. Britain's Sky News also reported receiving a security threat. The messages claimed responsibility for earlier aviation threats, although investigators had not independently established that the same person or organisation was responsible.
The sender promised further attacks, mentioning aircraft, cruise ships, underground stations and trains. Such declarations should be treated as threats rather than evidence of operational capability. But the message demonstrated an intention to exploit the publicity surrounding the incidents and extend the climate of fear.
Supermarkets and blood banks: Attacking everyday life
While airlines and broadcasters were dealing with bomb threats, another form of disruption was affecting essential civilian infrastructure.
On November 2, supermarket refrigeration systems in at least eight European countries were affected by a cyberattack. In Ireland, 13 SuperValu stores were affected, forcing retailers to remove chilled and frozen products from sale. In other European locations, refrigeration temperatures reportedly rose dramatically, in some cases reaching 50 degrees Celsius.
The affected equipment included refrigeration controllers manufactured by Danish company Danfoss and systems associated with Copeland/Dixell. Ireland's National Cyber Security Centre confirmed that controller systems had been compromised.
Online posts attributed to pro-Russian hacking groups NoName057(16) and Z-Pentest Alliance claimed responsibility for a joint attack involving Danfoss. Their responsibility for the supermarket disruptions has not been independently established, and the Kremlin rejected allegations of Russian involvement.
The same day, three regional blood banks in France experienced cyberattacks affecting refrigeration and control systems. French authorities said blood supplies were not affected. That qualification is important, but the targeting of systems responsible for maintaining essential medical supplies illustrates the potential consequences of attacks against civilian infrastructure.
The French government also accused Iran of involvement in the supermarket refrigeration incident and summoned the Iranian ambassador. Tehran rejected the accusations as baseless and hostile. Investigators have yet to establish a publicly demonstrated connection between the French allegations and the wider series of incidents.
The other incidents that cannot be ignored
The current wave also comes against a background of cyberattacks, suspicious incursions and alleged sabotage affecting European security.
Italy's Brenner Base Tunnel project, which will eventually connect Italy and Austria through one of Europe's major transport corridors, disclosed that its overseeing company had been hacked in October. The incident added another infrastructure-related concern to the security picture.
Italian Foreign Minister Antonio Tajani also disclosed that his personal information had appeared on the dark web. He blamed cybercriminals, while Meloni attributed the incident to pro-Russian hackers. The precise circumstances and responsibility should be distinguished from the government's accusation.
Romania has faced a particularly persistent set of security concerns. Russian drones have repeatedly entered or approached its airspace during the war against Ukraine, while Romanian authorities have described cyberattacks, disinformation, suspected sabotage and incidents involving cargo vessels near Romanian waters as elements of a wider hybrid threat.
On November 11, Romania's intelligence service disclosed that the Russian-linked hacking group Turla had carried out a cyberattack against an unnamed Romanian government institution in December 2025. The agency attributed the operation to a group linked to Russia's FSB security service. It said the attackers exploited vulnerabilities in Microsoft operating systems, but the operation was stopped, no sensitive data exfiltration was identified and the affected email service was repaired. This is a separately investigated, earlier attack, not proof that Russia directed the current bomb-threat campaign.
The wider European security picture also includes drone-related disruptions and investigations into suspected Russian sabotage. These incidents form part of the context in which the latest threats are being assessed, although they should not automatically be treated as components of one operation.
Who is behind the disruption?
Not me, says Vladi, but Russia and Iran have emerged as two possible suspects in different investigations; yet the evidence must be considered incident by incident.
Several European governments have accused Moscow of conducting or supporting hybrid operations intended to weaken countries assisting Ukraine. Russia denies these allegations. Iran, meanwhile, has rejected France's accusations concerning the supermarket cyberattack.
The appearance of the same purported sender, Mikhail Andropov, in threats against broadcasters and schools raises questions about whether a single individual, intelligence group or compromised network is responsible for at least some of the bomb hoaxes. It does not establish a Russian connection simply because the name sounds Russian or because the messages refer to extremist organisations.
There are other possibilities. Criminal groups, politically motivated hackers, opportunistic individuals and state-sponsored intermediaries can all exploit the same vulnerabilities. Different actors can also operate simultaneously, producing a cumulative effect that resembles a coordinated campaign without necessarily being directed from a single centre.
This is why European investigators need to establish whether the incidents share technical infrastructure, digital fingerprints, communication channels, financing or operational planning. Identifying the sender of an email is only one part of the investigation. Establishing who is behind the sender is considerably more difficult.
Europe cannot afford to treat each incident separately
The most revealing feature of this sequence is the choice of targets. Schools, airports, airlines, supermarkets, blood banks, broadcasters and transport infrastructure are not military installations. They are the everyday institutions on which European societies depend.
The objective of hybrid disruption, where it is deliberately employed, is not necessarily to destroy these institutions. It can be enough to interrupt their operations, force governments to divert resources, create public anxiety and undermine confidence in the ability of democratic states to protect their populations.
A bomb hoax can empty a school without an explosive device ever existing. A false warning can divert an aircraft and trigger an international security response. A compromised refrigeration system can threaten food supplies. A cyberattack against a blood bank can put essential medical infrastructure under pressure even when supplies remain safe.
Naturally the demand on police, intelligence agencies, cybersecurity specialists and emergency services accumulates. Thus, at considerable economic and psychological cost, Europe must improve intelligence-sharing, protect vulnerable civilian infrastructure, coordinate investigations and establish clear procedures for responding to threats without allowing every anonymous message to paralyse public life. It must also communicate honestly with its citizens, neither exaggerating the dangers nor dismissing incidents simply because no bomb is found.
Someone wants to destabilize Europe — and they are doing a good job disguising themselves. But the real test for European governments is not simply identifying the next threatening email. It is determining whether these incidents form part of a broader strategy, exposing the networks behind them and making European societies more difficult to disrupt.
No comments:
Post a Comment