Bomb threats against schools were sent from an email address in Taiwan

Around 10 a.m. last Wednesday, a threatening email was sent to 6,300 schools in Italy. "We are going to carry out a genocide of Italians," the email said, followed by a claim that an explosive device had been placed in a plastic bag inside the school.

Italy's equivalent of SOS Alarm received hundreds of calls in just a few minutes and around 300 principals judged the threat to be so serious that they evacuated the premises.

- They said it was a fire drill - just bigger than usual, an eight-year-old girl told the newspaper La Stampas posted outside a school in Turin.

Thousands of children stood shivering in the autumn cold in the school yards and many worried parents dropped everything to be able to go and pick them up. In the end it turned out to be a false alarm - but the scale has raised questions.

- Those behind this want to spread fear, suspicion and chaos, stated Italian Prime Minister Giorgia Meloni in a statement.

It is likely that the attackers had access to a database with contact details for state schools. Because on Thursday it was time again: New, aggressive threats were directed at over 1,800 schools and at the Chigi government palace, demanding the resignation of Prime Minister Meloni.

In Naples, Palermo and Genoa, among others, schools were evacuated. Elsewhere, principals chose to inform staff only, as the government's assessment was that the threats were false.

A bomb threat was also directed at a high school in Marseille, France, which was briefly evacuated. On Wednesday, schools in Scotland and Northern Ireland were affected - but there the threats were almost immediately written off as false. However, a few media outlets, including in Ireland, made short-term evacuations after being threatened.

In the emails sent to Italian schools on Wednesday, there was a sender address belonging to a female student at a university in Taiwan. Her account has reportedly been hijacked, according to the Taiwanese news agency Central News Agency, as cited by La Stampa. There is much evidence that those responsible wanted access to an email address from a well-known educational institution in order to reduce the risk of being caught in spam filters.

A similar method was used in the threats against flights earlier in November, when, among other things, an email address from the government health care agency in Bogotá, Colombia, was used as the sender.

That time, someone calling himself Michail Andropov took responsibility - as is the case now. In the emails to Italian schools, Michail Andropov claims to be the leader of "Vilayat Misogynistan".

However, it is probably only intended to create uncertainty. Andropov is a Russian surname and may allude to former KGB chief Yuri Andropov, Vilayat a term used by Islamist terrorists for "province", and Misogynistan probably a play on words intended to bring to mind misogynistic incel environments.

It is thus unclear which actors are behind the threats, but many observers believe that it is either a state that wants to spread uncertainty and fear, or individuals who are trying to cause chaos.

"We are not ruling anything out and will take all measures"

Earlier this week, France singled out Iran's Revolutionary Guard as responsible for the cyberattacks that raised the temperature in refrigerators and freezers in 700 French grocery stores in early October - three weeks before similar attacks took place in Sweden, among others.

- We are not ruling anything out and will take all measures, including those that are not public, that we believe are proportionate and necessary to deter and punish those responsible, French Foreign Minister Jean-Noël Barrot said at the time.

The regime in Iran denies involvement in the freeze attacks.

On Thursday, threats were also made against a train station in northern France, leading to delays for Eurostar trains running between Paris and London.