Bomb-threat emails to ~6,000 Italian and other European schools sent from university accounts previously exposed by infostealers
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 00:00; os links antigos trazem para cá.
On November 11, bomb-threat emails disrupted around 6,000 schools in Italy and affected institutions in Northern Ireland, Scotland and Ireland (infostealers.com). The emails were signed by a pseudonymous sender (securityaffairs.com). Hudson Rock researchers found two sender email accounts in infostealer data collections: one from an Egyptian university, exposed via Vidar in 2021, and one from a Taiwanese university, exposed in the AlienTXTBASE dataset more than a year before the threats (infostealers.com, securityaffairs.com). Both sources stress that there is no direct evidence the leaked credentials were used to send the threats, or that attackers kept continuous access to the accounts. The exposures predate the incident by a long time, which points to missed chances to invalidate credentials and monitor the accounts. Hudson Rock uses the case to argue for faster response to leaked credentials.
Detalhes técnicos
- Credential sources: Vidar stealer logs (Egyptian university account, 2021) and the AlienTXTBASE infostealer dataset (Taiwanese university account, over a year old) (infostealers.com, securityaffairs.com).
- The link between the stolen credentials and the threat emails is circumstantial. The accounts match the sender addresses, but account takeover is not confirmed. Securityaffairs.com also cites password reuse and old exposures as the risk that lets attackers spread fear and disruption.
Remediação
Hudson Rock's recommendations (securityaffairs.com, infostealers.com):
- Lock down affected accounts and reset passwords.
- Revoke active sessions.
- Clean infected devices.
- Adopt phishing-resistant authentication.
- Invalidate and monitor accounts found in infostealer exposures.
Linha do tempo
-
School Bomb Threat Emails Linked to Previously Stolen University Credentials
ler a análise desta fonte ocultar
On November 11, bomb-threat emails disrupted thousands of schools across Europe, including about 6,000 in Italy, signed by a pseudonymous sender. Hudson Rock researchers identified two university email addresses used to send threat emails within infostealer data breaches dating back over a year, one from an Egyptian university exposed in 2021 and one from a Taiwanese university exposed more than a year ago. Although the credentials were exposed, there is no direct evidence these accounts sent the malicious emails or that attackers maintained continuous access. The compromised credentials originated from Vidar and AlienTXTBASE-infostealer collections. The incident highlights risks from reused passwords and old exposures enabling attackers to spread fear and chaos. Hudson Rock suggests proper mitigation including account lockdown, password resets, session revocation, device cleanup, and adopting phishing-resistant authentication to prevent misuse of leaked credentials in such disruptive activities.
-
School Bomb Threats Linked to Infostealer-Exposed University Credentials in Italy and Taiwan
ler a análise desta fonte ocultar
On November 11, bomb-threat emails disrupted around 6,000 Italian schools and affected institutions in Northern Ireland, Scotland, and Ireland. Hudson Rock's investigation linked two sender email accounts used in these threats to infostealer malware data collections: an Egyptian university email compromised via Vidar malware in 2021, and a Taiwanese university account with leaked credentials from the AlienTXTBASE dataset dated over a year prior. These exposures predate the threats by significant periods, highlighting missed opportunities for mitigation through credential invalidation and account monitoring. Although possession of stolen credentials could have enabled access to the accounts involved, no direct evidence confirms that these credentials were used to send threatening messages. The findings underscore the crucial role of timely incident response to leaked credentials by institutions and providers to prevent abuse of exposed accounts.