Roughly 6,300 Italian schools opened their inboxes yesterday to find the same message: a bomb had been left on the premises, inside a plastic bag, wired for remote detonation. Within hours, at least 300 had evacuated, according to education minister Giuseppe Valditara, who warned the number could rise. Police searched buildings in Rome, Milan and across Emilia-Romagna, and parents up and down the country abandoned their working day to fetch children from the school gate.
The same email, or something very close to it, reached the UK and Ireland on the same day. Police Scotland put the Scottish figure at around 1,000 schools. In Northern Ireland, more than 300 schools were sent it, and the PSNI said it originated outside the UK. Schools in the Republic of Ireland were hit too.
The UK reaction was calmer. In a statement, Police Scotland said the messages had gone out to distribution lists across the UK and Northern Ireland, were assessed straight away and were being treated as hoaxes with no credible threat to the public. Its Cyber and Fraud Unit is now trying to trace the sender. Northern Ireland's Department of Education advised schools to stay open unless the PSNI said otherwise.
The emails were signed with a pseudonym, "Mikhail Andropov", who claimed to lead a non-existent "Vilayat of Misoginistan". The same alias had already claimed bomb threats emailed to newsrooms in Ireland and Bulgaria the previous Friday.
Schools were not the first target. On Tuesday, November 3, hoax threats against around seven flights and a cruise ship triggered searches and diversions, and briefly shut an airport outside Warsaw. Two days later a bigger wave followed, disrupting more than two dozen flights across at least ten countries, and more threats came on the Friday. An Aer Lingus service from Dublin to Rome was escorted by French fighter jets and put down in Normandy. UK transport secretary Heidi Alexander called the threats malicious hoaxes. Nothing was found on any aircraft.
Read next: Europe's wave of aviation bomb hoaxes puts war risk and terrorism cover in focus
Nobody yet knows who sent them. Italy's defence minister, Guido Crosetto, said Wednesday's emails fitted a clear strategy to spread fear and anxiety, but no government has formally named a culprit. Investigators are looking at a state-directed campaign, a lone sender and copycats. As Insurance Business has reported, the aviation threats were sent under the name of an anti-feminist group. That points away from a state actor, though it does not rule one out.
Mass email hoaxes have been used this way before. In October 2023, thousands of threatening emails, mostly written in Russian, hit schools, kindergartens and municipal buildings in Lithuania, Latvia and Estonia over several days. Lithuania's State Security Department later said it was most likely a coordinated attack initiated by hostile governments.
On November 9, France formally blamed Shahid Kaveh, a cyber unit linked to Iran's Islamic Revolutionary Guard Corps, for the October 11-12 attack that hijacked supermarket refrigeration systems. French officials say around 700 commercial sites were hit and at least 15 fires broke out. France's national cybersecurity agency, ANSSI, led the attribution.
Read next: Fridge hackers reach the UK - and the coverage gap comes with them
An emailed bomb threat causes disruption without damage, and most commercial cover is written around damage. A school, shop or office that clears its building because of an email usually has no physical loss to claim for, so the business interruption section does not respond.
Terrorism cover may not help either. Pool Re, the government-backed reinsurer for Great Britain, has offered non-damage business interruption since 2019, covering denial of access and loss of attraction where the underlying policy includes it. That cover depends on an incident being certified by HM Treasury as an act of terrorism, and Pool Re’s own scheme guide says threat, fear and bomb hoaxes fall outside its cover. Northern Ireland, where hundreds of schools received Wednesday’s email, sits outside the Pool Re scheme altogether.
The position may be shifting, however. Jonathan Gray, Pool Re’s chief underwriting officer, said guidance issued by HM Treasury in August 2025 has clarified how the definition of terrorism is interpreted, meaning hoax attacks “may be capable of certification even where there is no property damage”. “It depends on whether the incident itself meets the requirements to be certified as an Act of Terrorism,” he said.
That leaves any extensions a client has bought in the commercial market. Some property wordings carry denial-of-access cover that can respond to a police cordon or a closure ordered by the authorities, but cover for a voluntary evacuation after a hoax tends to be narrow, sub-limited or absent, and wordings vary. Brokers need to read the trigger wording itself.
Gray said the protection gap for non-damage business interruption widened considerably after Covid, and that the recent incidents are exposing it. The private terrorism market offers products with lower limits and alternative triggers, including cover for disruption arising purely from threats or security incidents that HM Treasury has not certified.
Read next: Fairford arrests expose the war exclusion gap behind terrorism cover
Attribution matters too. If a hostile state turns out to be behind a campaign like this, war exclusions start to matter as much as terrorism definitions. Insurance Business reported the same problem in aviation last week. A diversion can cost an airline up to $250,000 according to aviation security expert Philip Baum, most of it uninsured. Hull and liability policies respond to damage and injury, and a hoax causes neither. Many travel policies also exclude threats of terrorism as well as acts, which can leave passengers out of pocket for missed connections.
Many small businesses have no terrorism cover to begin with. Pool Re estimates that around 95% of UK SMEs have no terrorism cover at all, according to its guidance for small businesses.
Read next: 25 years after 9/11, terrorism cover still has blind spots
The gulf between the Italian and UK responses on Wednesday came down partly to planning. UK government guidance on bomb threats states that the vast majority are hoaxes designed to cause alarm and disruption, and asks organisations to judge credibility before deciding whether to search, evacuate or stay put. The Department for Education's school and college security guidance pushes schools to plan for exactly this scenario, and ProtectUK sets out when evacuation, invacuation or lockdown makes sense.
In Ireland, where some schools evacuated and others only spotted the email after it had landed in spam folders, the National Association of Principals and Deputy Principals called for a clear national protocol. For anyone advising schools, missing a threat and overreacting to one both cost money, and neither is usually insured.
Read next: Closing like the Louvre ahead of protests means lost trade, with no guarantee cover will follow
Gray said the success of UK counter-terrorism agencies has created “a ‘survivor bias’ illusion amongst most businesses and brokers that terrorism is something that only happens to other people”. A business without terrorism cover will probably have no protection at all under its property policy if an event is certified, he said, because policy terms usually exclude all cover beyond what terrorism endorsements provide.
Brokers with clients in education, hospitality, retail and venues may want to ask four questions.
No bomb was found at any school on Wednesday. Flights, newsrooms, supermarkets and schools have now all been targeted within a month, and police in Italy, Scotland, Northern Ireland and the Republic of Ireland are still investigating. Until wordings change, the cost of each wave stays with the schools, airlines and businesses that absorb it.
