School Bomb Threat Emails Linked to Previously Stolen University Credentials
On November 11, bomb-threat emails disrupted thousands of schools across Europe, including about 6,000 in Italy, signed by a pseudonymous sender. Hudson Rock researchers identified two university email addresses used to send threat emails within infostealer data breaches dating back over a year, one from an Egyptian university exposed in 2021 and one from a Taiwanese university exposed more than a year ago. Although the credentials were exposed, there is no direct evidence these accounts sent the malicious emails or that attackers maintained continuous access. The compromised credentials originated from Vidar and AlienTXTBASE-infostealer collections. The incident highlights risks from reused passwords and old exposures enabling attackers to spread fear and chaos. Hudson Rock suggests proper mitigation including account lockdown, password resets, session revocation, device cleanup, and adopting phishing-resistant authentication to prevent misuse of leaked credentials in such disruptive activities.
Linha do tempo
-
School Bomb Threat Emails Linked to Previously Stolen University Credentials
ler a análise desta fonte ocultar
On November 11, bomb-threat emails disrupted thousands of schools across Europe, including about 6,000 in Italy, signed by a pseudonymous sender. Hudson Rock researchers identified two university email addresses used to send threat emails within infostealer data breaches dating back over a year, one from an Egyptian university exposed in 2021 and one from a Taiwanese university exposed more than a year ago. Although the credentials were exposed, there is no direct evidence these accounts sent the malicious emails or that attackers maintained continuous access. The compromised credentials originated from Vidar and AlienTXTBASE-infostealer collections. The incident highlights risks from reused passwords and old exposures enabling attackers to spread fear and chaos. Hudson Rock suggests proper mitigation including account lockdown, password resets, session revocation, device cleanup, and adopting phishing-resistant authentication to prevent misuse of leaked credentials in such disruptive activities.