Email addresses used in European school bomb hoaxes spotted in old infostealer logs

When Italy’s schools were flooded with bomb‑threat emails last week, the panic was real – thousands of pupils evacuated, emergency services were dispatched, and rail services were halted. Yet the real story that matters to anyone running a data centre or a hosted service is how two university accounts, exposed in infostealer dumps years ago, were used as the launchpad for the hoax. The timeline is stark: one address from Kafrelsheikh University in Egypt showed up in Vidar logs as early as October 2021, and another from Dayeh University in Taiwan was part of the massive AlienTXTBASE dump dated February 2025. Those credentials sat idle, un‑revoked, while the universities and their identity provider – Microsoft – had ample opportunity to scrub them. The result? A simple email, signed with a fictitious “Mikhail Andropov,” was enough to trigger a national emergency response. For founders, that’s a wake‑up call that credential exposure is not just a fraud problem; it’s a direct route to operational disruption.

Why infostealer logs matter now more than ever

Modern threat‑intelligence platforms make infostealer dumps highly visible. Hudson Rock’s analysis highlighted that the two compromised university accounts were sitting in public logs well before the bomb‑threat campaign, creating a “substantial window” for mitigation. In practice that means any organisation that relies on password‑based authentication must treat a single exposed address as a critical incident, not a low‑priority data‑leak. The fact that the attackers could have leveraged those credentials without needing to prove they used the exact password – there are “many ways to get around password‑based authentication” – underscores the fragility of legacy auth models.

For hosting providers, the lesson is clear: credential hygiene is a business‑risk issue. If a single compromised admin account can be used to send mass phishing or threat emails, the same vector can be turned against your customers, your brand, and your bottom line. Ignoring infostealer alerts is tantamount to leaving the back door open for anyone with a script and a grudge.

The operational impact of a credential‑driven hoax

The bomb‑threat emails reached about 6,300 of Italy’s 7,476 state schools, forcing roughly 390 evacuations. The ripple effect spread beyond Italy – schools in France, Ireland, Northern Ireland and Scotland received similar messages, and rail services, including Eurostar, were disrupted. Even media organisations like RTÉ had to evacuate premises, causing programming delays. The cost of such a disruption runs into millions when you factor in emergency services, lost productivity, and the intangible damage to public confidence.

From a founder’s perspective, the operational fallout demonstrates how a single compromised account can generate a cascade of “chaos‑as‑a‑service.” The attackers didn’t need sophisticated malware; they needed a valid email address that could bypass basic spam filters and appear credible enough to trigger emergency protocols. That’s the exact scenario many of our clients fear – a breach that doesn’t steal data but forces them to shut down services, scramble resources, and field media inquiries.

What the investigation still needs

Hudson Rock noted that definitive attribution requires email headers, sign‑in events, and audit logs from the providers. Those details would reveal whether the sender actually authenticated with the compromised credentials or simply spoofed the address. Even if authentication was confirmed, it would not prove the password came from the infostealer dump – there are “many ways to get around password‑based authentication.” Nonetheless, the presence of the addresses in the dumps is enough to trigger a red flag for any organisation that manages university or corporate accounts.

The broader implication is that threat‑intel feeds must be integrated into day‑to‑day security operations. If a university’s security team had acted on the Vidar and AlienTXTBASE sightings, they could have forced password resets, revoked tokens, and monitored for anomalous logins. The fact that the exposure lingered for years points to a systemic gap in how institutions treat credential‑leak alerts.

Why “best practices” often crumble in production

Industry “best practices” frequently prescribe multi‑factor authentication (MFA) and regular password rotation. Yet the reports show that both universities relied on Microsoft for authentication, presumably with MFA enabled, but still suffered exposure. The reality on the ground is that MFA can be bypassed through session‑hijacking, phishing, or the use of “password‑less” tokens that are stolen alongside credentials. Moreover, many organisations treat MFA as a checkbox rather than a continuously monitored control, leaving gaps that attackers can exploit.

From my decade of running production servers, I’ve seen the same pattern repeat: a theoretical control is in place, but the operational discipline to audit, rotate, and revoke compromised secrets is missing. When a credential appears in a public dump, the response must be immediate – lock the account, force a reset, and hunt for any session that may have persisted. Otherwise you’re just paying lip service to compliance while leaving a back‑door wide open.

Business‑risk lens: the cost of complacency

For independent hosting providers, the cost of a credential‑based hoax can far exceed the price of a premium security solution. The Italian episode forced emergency services to mobilise, rail operators to cancel services, and schools to shut down – all because a single compromised university address was used as a vector. If a similar attack targeted a hosted email service, the provider could face massive SLAs penalties, brand damage, and potential legal exposure for failing to protect customer data.

What’s more, the incident highlights the interconnectedness of the supply chain. The universities used Microsoft authentication; the attackers leveraged that ecosystem. Hosting providers that integrate third‑party identity services must demand real‑time breach‑feed integration from those vendors. If Microsoft had surfaced the Vidar and AlienTXTBASE alerts to the universities promptly, the window for abuse could have been closed.

Actionable steps for founders and security teams

First, ingest threat‑intel feeds that surface infostealer dumps and treat any match as a high‑severity incident. Automate account lock‑out and forced password rotation the moment a credential appears in a dump. Second, enforce credential‑less authentication wherever possible – hardware‑based tokens, certificate‑based logins, or password‑less WebAuthn – to reduce reliance on passwords that can be harvested en‑mass. Third, conduct regular audits of all third‑party identity providers, ensuring they have a documented process for rapid revocation of compromised accounts.

Finally, build a response playbook that goes beyond “detect‑and‑alert.” Include steps to notify affected customers, coordinate with law‑enforcement, and publicly communicate the mitigation actions taken. Transparency, coupled with swift technical remediation, can turn a potential PR disaster into a demonstration of resilience. In a world where a single leaked email can shut down schools, railways, and media outlets, the only sensible strategy is to treat credential exposure as a critical business‑risk vector and act accordingly.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: The Register; theregister.com; Global1.News (14 November 2026).

By Allan Ali, Global1.News