The School Bomb Threats Came From Accounts Already in Stolen Data

Two university email accounts used to send bomb threats to over 6,000 Italian schools were already present in infostealer-harvested credential dumps, meaning the accounts had been compromised before the threats were even sent. This incident illustrates how stolen credentials can sit in criminal markets for extended periods, enabling malicious actors to abuse legitimate institutional accounts for high-impact activities like mass threat campaigns. The use of a real university email address lends false legitimacy to such threats and complicates attribution. Organizations that fail to monitor for credential exposure and enforce strong account hygiene leave their users — and third parties — vulnerable to downstream abuse of compromised identities.