The School Bomb Threats Came From Accounts Already in Stolen Data
Summary: On 11 November, bomb-threat emails signed "Mikhail Andropov" hit schools across Europe, with ANSA reporting about 6,000 Italian schools received them and Northern Ireland police saying more than 300 schools got the same message. Hudson Rock reports that two university email addresses tied to the threats appear in its stolen-credential data - one in a Vidar infostealer record from 1 October 2021 holding 112 saved credentials, the other in the AlienTXTBASE collection added to Have I Been Pwned in February 2025 - while stating only that the credentials were exposed, not that they were used to send the emails.
What you should know: A single infected Windows 7 machine in 2021 exported 112 saved credentials, and one of those university identities surfaced in threat material more than five years later - the record proves exposure and nothing more, which is exactly why a password reset alone does not close it.
Read the original at Security Affairs ↗