# Bomb threats in Italian schools, diverted flights and hacked fridges: not the same cyberattack > Today an email signed "Mikhail Andropov" set off bomb alerts in 312 Italian schools. Last week the same name was behind threats to newsrooms, in the days when dozens of flights were diverted by fake bomb alerts. And since October someone has been remotely raising the temperature of supermarket fridges. The papers call them all hacker attacks, but only one of them really is. - URL: https://mautoblog.com/en/posts/school-bomb-threats-hacked-fridges-europe-2026/ - Language: en - Published: 2026-11-11 - Author: Matteo - Categories: Security and Privacy, Culture and Society - Tags: Cybersecurity, Digital Society, Politics - Translation (it): https://mautoblog.com/posts/allarme-bomba-scuole-frigoriferi-hacker-2026/ --- This morning hundreds of Italian head teachers opened their inbox and found a bomb in it. A fake one, as became clear within a few hours, but in the meantime the schools had to be evacuated. Many Italian papers call it a **hacker attack**: the same label used last week for the planes diverted by fake bomb alerts, and for a month now for supermarket fridges warming up on their own. Three stories, often in the same headline. I think the first two belong together and the third should be kept apart, and it's worth understanding why. --- ## What happened in Italian schools today On 11 November a threatening email reached **312 Italian schools**, according to education minister Giuseppe Valditara: about twenty in Rome alone, then from Basilicata to Friuli ([Il Foglio](https://www.ilfoglio.it/cronaca/2026/11/11/news/attacco-hacker-alle-scuole-di-roma-allarme-bomba-in-venti-istituti-la-prefettura-conferma-al-foglio--413344)). It was signed by one "Mikhail Andropov", self-styled leader of an imaginary "Vilayat of Misoginistan". The text talks about devices in the buildings and a "genocide of Italians". Similar messages reached schools in Ireland, Northern Ireland and Scotland today too ([CyberSecItalia](https://www.cybersecitalia.it/allarme-bomba-nelle-scuole-italiane-dopo-la-casalinga-di-voghera-il-cyber-caos-arriva-ai-bambini/71804/)). It isn't the first time. On 2 November another email reached 271 schools: that time the sender claimed to speak for Iran's Revolutionary Guards and even named a Ryanair flight that was in the air at the time ([IBTimes](https://www.ibtimes.co.uk/rome-school-evacuated-after-bomb-threat-email-claiming-irans-guards-targets-271-schools-1829999)). In Rome, 1,800 pupils and staff from the Giovanni Cagliero complex ended up in a park. No explosives anywhere. Valditara said the real risk was "practically non-existent". Prime minister Giorgia Meloni called ministers, intelligence chiefs and the national cybersecurity agency to a meeting at Palazzo Chigi at 4 pm. ## In between, the bomb threats on planes Between the two waves on schools came the planes. On 3 November a first round of threats hit a handful of flights in Europe, two of them bound for Rome. On 5 November, between 9:55 and 11:00, at least 25 flights were targeted ([AGI](https://www.agi.it/cronaca/news/2026-11-05/allarme-bomba-voli-italia-dirottati-39889129/)): - a Finnair flight from Helsinki to Rome Fiumicino was escorted by two Eurofighters scrambled from Grosseto and landed as planned; - an Aer Lingus flight from Dublin to Rome was intercepted by French fighter jets and made to land at the Évreux air base in Normandy, after the captain had refused that destination; - a Wizz Air flight from Milan Malpensa to Warsaw ended up in Vienna, and three Ryanair flights made emergency landings in Bulgaria. The next day a Wizz Air flight from Prague to Rome was diverted to Venice, Hungary scrambled its jets three times and the threats reached newsrooms too: RTÉ's offices in Dublin were evacuated, and Nova TV in Bulgaria received the same message. The signature was today's, **"Mikhail Andropov"**, and according to Il Foglio those messages also claimed the flight alerts ([Al Jazeera](https://www.aljazeera.com/news/2026/11/6/new-bomb-threats-target-european-broadcasters-air-traffic)). The method, once again, was email. At Malpensa an anonymous email in Italian sent to a public office said they would put a bomb on the planes. At Rome's airports the emails had the subject line "segnalazione minaccia" (threat report) and came, according to [Il Post](https://www.ilpost.it/2026/11/05/aereo-diretto-a-roma-ridirottato-in-francia-allarme-bomba/), from a Russian extremist group that preaches hatred of women and gay people. The same theme as the "Vilayat of Misoginistan" that signs the school emails. Nobody has officially attributed these threats yet, and the EU transport commissioner said it's too early to say whether they're linked. But signature, tone and method look a lot alike. Italy's defence minister Guido Crosetto called it "sub-threshold warfare". ## Are the bomb threats on schools and flights a cyberattack? Let me be pedantic here. Sending the same email to three hundred schools or to an office at Malpensa is not a cyberattack. Nobody got into the schools' systems, nobody stole any data. School email addresses are public, they're on every school's website. At most there's a stolen account or a forged sender. I've seen the email one school received today: subject line "Avviso di pericolo" (danger notice), sent at 10:00 from an account on Dayeh University's cloud mail in Taiwan (`cloud.dyu.edu.tw`), written in Italian. On 2 November the sender was an address tied to Egypt's education ministry instead. That says little about who wrote them: they're the usual borrowed addresses, probably belonging to some student who doesn't even know they lent them out. The weak spot being exploited isn't software but a procedure. A school that receives a bomb threat has to evacuate, and rightly so: the head teacher can't know the same email reached 311 other schools. The minister can, and that's why he can say it isn't credible. From inside a single school, the same email looks real. With planes it's the same, only more expensive: no authority can afford to ignore a threat against a flight in the air, so planes get diverted, jets get scrambled and passengers are taken off in a safe area. It's the same trick as in October in the UK, when about 300 schools across Northern Ireland and Scotland received an identical message ([Euronews](https://www.euronews.com/2026/10/19/northern-ireland-and-scotland-schools-sent-hoax-bomb-warnings-officials-say)). Cost to the sender: an hour and a list of addresses. Cost to everyone else: lost mornings, anxious parents, police busy searching empty gyms. --- ## The fridges, on the other hand, are a real cyberattack The fridge story is something else. Here someone really did get into the systems. **France, 11 and 12 October.** About 700 sites hit: Carrefour, Leclerc, Intermarché, Casino, Metro, but also butchers, a slaughterhouse and food-processing plants. The attackers took over the Danfoss controllers that run refrigeration and remotely changed the defrost settings, pushing the units into continuous heating. The result: tens of millions of euros of food thrown away and at least 15 fires ([BleepingComputer](https://www.bleepingcomputer.com/news/security/france-blames-iranian-hackers-for-supermarket-attacks-that-sparked-fires/)). On 9 November France attributed the attack to Shahid Kaveh, a unit of Iran's Revolutionary Guards, summoned the ambassador and called for EU sanctions. **Europe, 2 November.** A second wave hit more than 115 stores in six countries, including Sweden, Belgium, Ireland, Luxembourg and Estonia. This time there's no official attribution: France only talks about October, and a 4 November claim by pro-Russian groups hasn't been verified. **Italy.** The impact here was limited, according to the government: a few supermarkets in Sicily and, among others, SIAF in Bagno a Ripoli, which prepares meals for school canteens and hospitals around Florence. The company says it spotted the anomaly straight away and service never stopped ([NewsIstruzione](https://www.newsistruzione.it/2026/11/04/attacco-hacker-frigoriferi-siaf/amp)). So yes, schools are involved here too, if only at the edges. How did they get in? No evil genius. According to Italy's national cybersecurity agency, the French attacks exploited old installations, admin panels reachable straight from the internet and weak authentication ([Adigitali](https://www.adigitali.it/articoli/attacco-hacker-refrigerazione-supermercati-catena-del-freddo)). Danfoss admitted that two of the most affected controllers hadn't had software support for years. According to Sky TG24, about 13,000 networked refrigeration services can be found with a search engine ([Sky TG24](https://tg24.sky.it/mondo/2026/11/04/attacco-hacker-frigoriferi-supermercati)). In plain words: years ago someone put the fridge online so they could check it from their phone at the weekend. Then nobody touched it again. --- ## The common thread: cheap to do, very scary Italy's interior minister Matteo Piantedosi talks about a coordinated European initiative. For schools, planes and newsrooms the shared signature points that way, even though there's no known author yet. The fridges have an attribution only for October, to Iran. And there's no reason to assume that whoever writes from a Taiwanese address is the same person warming up Swedish freezers. What these stories share, in my view, is the economics. One email evacuates 312 schools or scrambles two Eurofighters. One controller forgotten on the internet means tonnes of food in the bin. The attacker spends almost nothing; the defender spends time, money and peace of mind. That's the simplest definition of hybrid warfare: you don't need to destroy anything, you just need to force the other side to react. And there's a side effect that worries me more than the fake bombs. If every threatening email becomes a "hacker attack", the phrase stops meaning anything. And when a real attack comes along, like the fridges, it just looks like another story in the series. --- ## And at home? On 10 November the head of ENISA, the EU cybersecurity agency, warned the European Parliament that the next targets could be routers and home appliances ([ANSA](https://www.ansa.it/sito/notizie/mondo/2026/11/10/agenzia-ue-attacchi-hacker-potrebbero-colpire-anche-elettrodomestici_28703d89-c3b2-4c05-8315-d0e77f5339ba.html)). It isn't science fiction: the mechanism is the same as in the supermarkets. I say this with some embarrassment. A few days ago, while writing the post on [Node2Shell](/en/posts/node2shell-nodejs-brotli-flaw-who-updates-runtime-2026/), I checked what my Mac was exposing on my home network. I found databases and services in Docker containers reachable from any device on the Wi-Fi, because their ports were open to the whole network instead of just to the Mac. They didn't reach the internet, but the mistake was the same as with the fridges: stuff put on the network for convenience and forgotten. So, without panic, here's what's worth doing: - change the router's admin password, if it's still the one printed underneath; - turn off UPnP unless you know what you need it for: it's the feature that opens ports to the internet without asking you; - update your router, cameras and smart plugs, and if a device no longer gets updates, move it to the guest network; - before buying a "smart" appliance, ask yourself whether you really need to switch it on from your phone. For schools, on the other hand, technology helps little. What's needed is someone above the single head teacher who sees straight away that the same email reached three hundred schools and tells everyone quickly, before the playgrounds fill up. Have you seen any of these stories up close, at school, at an airport or at work? [Let me know](/en/contact/). --- *Sources: [AGI](https://www.agi.it/cronaca/news/2026-11-05/allarme-bomba-voli-italia-dirottati-39889129/), [Il Post](https://www.ilpost.it/2026/11/05/aereo-diretto-a-roma-ridirottato-in-francia-allarme-bomba/), [Al Jazeera](https://www.aljazeera.com/news/2026/11/6/new-bomb-threats-target-european-broadcasters-air-traffic), [Il Foglio](https://www.ilfoglio.it/cronaca/2026/11/11/news/attacco-hacker-alle-scuole-di-roma-allarme-bomba-in-venti-istituti-la-prefettura-conferma-al-foglio--413344), [CyberSecItalia](https://www.cybersecitalia.it/allarme-bomba-nelle-scuole-italiane-dopo-la-casalinga-di-voghera-il-cyber-caos-arriva-ai-bambini/71804/), [IBTimes](https://www.ibtimes.co.uk/rome-school-evacuated-after-bomb-threat-email-claiming-irans-guards-targets-271-schools-1829999), [Euronews](https://www.euronews.com/2026/10/19/northern-ireland-and-scotland-schools-sent-hoax-bomb-warnings-officials-say), [BleepingComputer](https://www.bleepingcomputer.com/news/security/france-blames-iranian-hackers-for-supermarket-attacks-that-sparked-fires/), [Security Affairs](https://securityaffairs.com/?p=202742), [Sky TG24](https://tg24.sky.it/mondo/2026/11/04/attacco-hacker-frigoriferi-supermercati), [Adigitali](https://www.adigitali.it/articoli/attacco-hacker-refrigerazione-supermercati-catena-del-freddo), [NewsIstruzione](https://www.newsistruzione.it/2026/11/04/attacco-hacker-frigoriferi-siaf/amp), [ANSA](https://www.ansa.it/sito/notizie/mondo/2026/11/10/agenzia-ue-attacchi-hacker-potrebbero-colpire-anche-elettrodomestici_28703d89-c3b2-4c05-8315-d0e77f5339ba.html).*