The Anatomy of the Breach
In a chilling example of how legacy credential theft can weaponize everyday digital infrastructure, two university email addresses linked to a massive wave of bomb threats against thousands of Italian schools were found to have been exposed in infostealer logs for over a year. Researchers at Hudson Rock conducted an investigation into the origin of these threats, revealing that the accounts—one belonging to Egypt’s Kafrelsheikh University and the other to Taiwan's Dayeh University—had been compromised long before they were leveraged to incite panic across Europe.
The data regarding the Egyptian account was harvested by Vidar, a pervasive malware strain that specializes in stripping saved passwords and credentials from infected hardware. This specific exposure dates back to October 2021. Meanwhile, the Taiwanese account was discovered within the massive 'AlienTXTBASE' infostealer repository, a dump containing over 284 million records dating to February 2025. These findings underline a critical gap in organizational security: the failure to rotate credentials and monitor dark web leaks for compromised staff or student accounts, even those appearing to be low-priority targets.
The Scope of the Disruption
Between November 11 and November 12, the coordinated campaign struck a staggering 6,300 Italian state schools, triggering widespread evacuations and straining emergency resources. The emails, which utilized disturbing rhetoric involving genocide and remote-detonated explosives, were signed by a fictitious figure claiming to lead the 'Vilayat of Misoginistan.' While the threats were quickly deemed hoaxes by authorities—including Italian Prime Minister Giorgia Meloni—the societal impact was immediate. Beyond Italy, the chaos rippled across France, Ireland, Northern Ireland, and Scotland, resulting in school closures, broadcast interruptions at media outlets like RTÉ, and even threats against international rail services like Eurostar.
The methodology suggests a sophisticated effort to sow discord. The use of university-grade email addresses provides a veneer of legitimacy that helps bypass basic spam filters and increases the psychological impact on the public. By targeting institutional email accounts, the perpetrators effectively turned the universities' own infrastructure into a platform for psychological warfare, forcing nations to mobilize police, military fighter jets for flight escorts, and emergency responders to address threats that ultimately lacked any foundation in reality.
Why It Matters
This incident serves as a stark warning to organizations regarding the longevity of leaked credentials. In the current threat landscape, a password stolen in 2021 remains a viable vector for a 2026 cyber-incident unless proactive measures are taken. The security community emphasizes that modern threat intelligence makes these infostealer logs highly visible; therefore, the window of exposure for these two universities represented a failure to identify and neutralize known risks.
- Account Hygiene: Organizations must treat credential exposure in infostealer logs as an immediate emergency, mandating password rotation and forced re-authentication.
- Beyond Financial Fraud: While companies often monitor for direct data theft, this event proves that 'ordinary' user accounts can be hijacked to perform massive, disruptive public safety hoaxes.
- Verification Challenges: Identifying whether the sender actually used the stolen password or simply spoofed the address remains difficult, highlighting the necessity for advanced email auditing and header analysis in incident response.
The researchers noted that while they could not confirm if the perpetrators accessed the accounts via these specific stolen credentials, the accessibility of the email addresses in public databases provided a clear path to action. As the investigation continues, the event reinforces the necessity for a zero-trust approach to institutional email, where even university-affiliated accounts must be subject to stringent audit logs and proactive threat hunting to prevent them from becoming the next tool for global chaos.
