# Italian school bomb hoaxes involved addresses found in earlier data leaks

- URL: https://talkfuse.com/story/email-addresses-used-in-european-school-bomb-hoaxes-spotted-in-old-infostealer-logs/
- Published: 2026-11-13T16:41:00+00:00
- Updated: 2026-11-13T16:48:56+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/cyber-crime/2026/11/13/email-addresses-used-in-european-school-bomb-hoaxes-spotted-in-old-infostealer-logs/5309765
- Topics: Europe, Research, Science, World

## Key points

- Two university email addresses appeared in infostealer logs before the hoaxes.
- Researchers say the exposure does not prove how the threats were sent.
- About 6,300 Italian state schools received fake threats.

## Summary

Two email addresses used in bomb threat hoaxes that disrupted thousands of Italian schools appeared in infostealer logs well before the emails were sent. Researchers say the findings highlight how exposed accounts can become a route to causing disruption, and why organizations should act on credential exposures promptly.

One address from Egypt’s Kafrelsheikh University was recorded by the Vidar infostealer in October 2021; another from Taiwan’s Dayeh University appeared in a February 2025 dump containing 284 million addresses. Their presence in the logs does not prove the hoax sender used stolen credentials, and investigators would need email headers and provider records to establish how the messages were sent. Around 6,300 of Italy’s 7,476 state schools received threats on 11 and 12 November, with about 390 evacuating; similar emails also reached schools elsewhere in Europe.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.