For the third time within ten days, a wave of anonymous bomb threats has struck Italian schools. According to Palazzo Chigi, on 12 November 2026 threatening emails reached 3,778 schools across Italy, 77 of which were evacuated; in 36 schools, lessons resumed on the same morning. Affected cities include Milan, Genoa, Trieste, Bologna, Faenza, Forlì, Rome, Naples, Salerno, Palermo and Catania, as well as schools in Puglia, Molise and the Rieti area of Lazio.Confirmed evacuations took place at, among others, the Liceo Umberto I in Palermo on Sicily,as well as in Rome, Naples and Larino in the province of Campobasso.
A Chronicle of the Wave Since Early November
The series began on 2 November 2026, when an email was sent to 271 Italian schools, eight of them in Rome. The Giovanni Cagliero school complex, including the Gianni Rodari primary school in Rome's Tuscolano district, was evacuated; around 1,800 pupils and staff relocated to the Villa Lais. The anonymous sender claimed to be acting on behalf of the Iranian Revolutionary Guards, threatened a bomb made from ammonium nitrate and announced further attacks on survivors. On 11 November, according to ANSA, the largest wave so far followed, with 6,000 schools threatened and the message "Vi annienteremo." On 12 November, the third wave targeted 3,778 schools, with the number of evacuations falling to 77. In parallel, threats against flights and airports in Italy emerged in early November, briefly affecting Fiumicino and Malpensa as well.
Pozzuoli: Improvised Explosive Devices at the Istituto Nautico
Alongside the email wave, a concrete Pozzuoli, in the Metropolitan City of Naples, incidentoccurred. On the morning of 3 November 2026, cleaning staff at the Istituto Tecnico Nautico discovered two improvised explosive devices near the perimeter gate close to Piazzetta Bagnoli. According to News Istruzione, the devices consisted of three and four so-called Cobra elements respectively, bound and secured with insulating tape. The Carabinieri from the Nucleo Artificieri of the Comando provinciale di Napoli attended the scene, made the devices safe and confiscated them. The building was not evacuated. No information is available on the perpetrator or motive; the incident is not connected to the email wave in terms of the investigation, but falls within the same timeframe.
Email Signatures and Compromised Teacher Accounts
The current wave of 12 November bears the signature Mikhail Andropov and demands the immediate resignation of Prime Minister Giorgia Meloni, with the sender threatening hundreds of casualties should this not occur. The same signature appeared on 11 November. According to findings by the Rome public prosecutor's office, the emails were sent via compromised accounts belonging to real teachers and staff, at least three of them from the Philippines and one from Pakistan. The 11 November wave originated from the account of a Taiwanese student; the account holders are considered uninvolved. The emails sent to airports the previous week bore the signature "Combattenti dello Stato maschile" and, according to the tracing report, originated from Colombia and the United Arab Emirates respectively. Investigators are examining a possible link between the school and airport threats, as well as a possible Russian origin, though the Polizia Postale states that no evidence of this has been found so far.
Palazzo Chigi: No Automatic Evacuation
The Italian government has responded to the repeated mass threats with a new policy. Palazzo Chigi instructed prefects and school heads not to evacuate in response to mass emails alone. According to the official guidance, prefects may order evacuations only when "specifici e concreti" elements are present, meaning concrete indications of a genuine threat. The marked drop in evacuations between 11 and 12 November, when only 77 of the 3,778 threatened schools were cleared, is cited as evidence of the effectiveness of the new policy. Giorgia Meloni had previously spoken of a "strategia per il caos" and invited opposition parties to a meeting at Palazzo Chigi. The counter-terrorism unit, the national cybersecurity agency and the intelligence services are involved in the investigation, according to Foreign Minister Antonio Tajani.
What Parents and School Heads Should Know at Present
According to the public prosecutor's office, all school threats in Italy known so far are without genuine substance.No explosives have been found in any of the threatened schools. The government recommends paying attention to communications from the relevant school heads and prefectures, and not treating mass emails as an immediate threat as a matter of course. Parents are advised to wait for individual communications from the school before collecting children early. The Polizia Postale continues to gather reports on the teacher accounts used, as the perpetrators appear to be exploiting these via hacked government websites in the Philippines and similar channels. The Pozzuoli case at the Istituto Nautico is to be treated as a separate matter in terms of the investigation; Carabinieri inquiries into the actual discovery of explosive devices there are ongoing.
