Susanna Riva In the early hours of November 12, 2026, shortly before 10:00 a.m., a series of emails was sent to nearly 3.800 schools across the country. The text, signed by the fictitious "Mikhail Andropov," warned: "The building has been mined, and at this very moment your life is in danger ," adding a bomb warning for Palazzo Chigi.
The alarm generated immediate panic, although the chaos of the previous day was not repeated.
Email threat to nearly 3800 schools
The message was identical for all recipients, but unlike the previous wave, the emails came from several compromised addresses using Philippine and foreign domains. Some of these senders were linked to a teacher in Davao, Jorhaida Budiang, and a school in Batangas City, suggesting the use of credentials stolen or purchased on the dark web.
In total, 1.803 emails were delivered in real time, creating a network of bomb threats unprecedented in the recent history of Italian schools.
Compromised addresses and Filipino origin
Preliminary investigations have revealed that the hacked accounts include domains linked to Philippine educational institutions. The author of the message, "Mikhail Andropov," presents himself as the leader of a virtual group called "Vilayat of Misoginistan."
The choice of a Russian-style name and the use of a Taiwanese account that had already been compromised the previous day indicate a strategy aimed at confuse the authorities, taking advantage of the speed of diffusion of email platforms.
Institutional response: guidelines and operations
Faced with this emergency, the government issued an urgent communication to all principals and prefects, urging them not to order evacuations without concrete evidence beyond the mass emails. The directive, issued mid-morning, emphasizes the need to assess each threat with more rigorous criteria to avoid shutting down essential services. Only 77 buildings were evacuated, of which 36 resumed classes a few minutes later, while most students remained in classrooms.
CISR meeting and the role of ministers
This afternoon, the Committee for the Security of the Republic (CISR) met in a technical session with the heads of intelligence agencies, the Cybersecurity Agency, Undersecretary Alfredo Mantovano, Minister of Education Giuseppe Valditara, and Minister of the Interior Matteo Piantedosi. The stated objective is to prevent unfounded threats from disrupting essential services and to ensure the safety of students, school staff, and families. It was agreed that, for each sector, central governments will provide operational indicators and chains of command to quickly identify false alarms.
Criminal investigations and international cooperation
The Rome and Milan prosecutors' offices have opened investigations into causing alarm , aggravated threats, and public intimidation. The Rome prosecutor's office's anti-terrorism team, led by Chief Prosecutor Francesco Lo Voi, is gathering testimonies from the affected schools, while the Milan prosecutor's office is investigating possible unknown perpetrators. At the same time, the Postal Police and security forces are tracing mail server routes, with the support of Europol, to identify the origin of the messages and verify any links to other recent attacks, such as the emergency landings of commercial flights overtaken by military fighter jets.
A limited technical meeting will be held the following morning to define short-, medium-, and long-term operating procedures . In addition to schools, the focus will extend to hospitals, transportation infrastructure, telecommunications, and local authorities, with the aim of developing rapid, nationally shared response protocols.
Meanwhile, authorities have emphasized that threats unsupported by concrete evidence do not justify the suspension of school activities. Principals are urged to provide the Prefect with all available information for a thorough assessment, while the government declares its readiness to report the measures adopted to Parliament in the coming days.