One email, 7,600 schools, three countries: who is 'Mikhail Andropov'?

About 6,300 of Italy's 7,476 state schools received a bomb threat by email on Wednesday 11 November 2026. Hundreds were evacuated. In Scotland, at least 1,000 schools received the same hoax email; in Northern Ireland, about 300. The email was signed 'Mikhail Andropov, leader of the Vilayat of Misoginistan' — the same purported sender linked to bomb threats emailed to newsrooms in Ireland and Bulgaria the previous Friday. That signature is the thread connecting a campaign that stretched across three countries and two sectors in less than a week, and it is the reason the response cannot stop at national borders.

The immediate official reaction was measured and, on the evidence available, correct. Italian Prime Minister Giorgia Meloni said checks had found no evidence of 'concrete danger' and described the campaign as intended to cause alarm. Scotland's education secretary Mairi McAllan said there was no risk to the public and that specialist cyber-crime officers were working to identify the source. Northern Ireland's Assistant Chief Constable Anthony McNally said the risk to the public was 'low'. Police and government officials widely assessed the threats as hoaxes. That is the right call: the physical risk was low, and treating every email as a credible device would hand the sender exactly the disruption they sought.

But low physical risk is not no harm. Thousands of schools were disrupted. Hundreds of evacuations in Italy alone consumed police time, closed classrooms and frightened children and parents. The cost of a hoax is borne by the institutions that must respond to it, and the ease of sending one is the whole point. A single anonymous email, sent from anywhere, can force a national response. That asymmetry — one sender, thousands of targets, three jurisdictions — is what makes this more than a nuisance.

The 'Mikhail Andropov' signature matters because it links the school threats to the earlier newsroom threats in Ireland and Bulgaria. If the same actor is behind both, then this is not a one-off spasm but a pattern: civilian infrastructure targeted with hoaxes, apparently aimed at sowing fear rather than causing physical harm. The open questions are the right ones. Who is behind the persona and the Vilayat of Misoginistan signature? Is it a state actor, a criminal group, or an individual? Are the threats in Italy, Scotland and Northern Ireland definitively connected, or merely similar in nature? Officials have not said. Meloni suggested further waves were possible. That uncertainty is itself a reason to treat the cross-border dimension as the priority, not an afterthought.

The strongest case against that position deserves a fair hearing. Without confirmation that the same person or group sent all the emails, treating them as one actor may misdirect resources and overlook copycat threats. A signature is not an identity. Anyone can type 'Mikhail Andropov'. The same text can be copied, forwarded or independently reinvented by people with no connection to the original. If investigators assume a single hand, they may build a profile that fits the signature rather than the sender, and miss the local teenager, the prankster, or the separate group that saw the news and decided to join in. Copycats are a real phenomenon, and a cross-border manhunt for one phantom actor could leave the actual senders of individual emails untouched.

That is a serious objection, and it should shape how the investigation is run rather than whether it is run. The answer is not to abandon the cross-border angle but to pursue it without collapsing every email into one actor. The signature is a lead, not a verdict. Investigators can trace the emails' technical origins, compare wording and timing across the school and newsroom incidents, and keep open the possibility of multiple senders while still treating the apparent coordination as the central question. The alternative — each country investigating in isolation, sharing nothing, and hoping the sender does not simply move to the next jurisdiction — is how a single anonymous actor keeps operating.

That is why international cyber-crime cooperation is the practical priority. The emails crossed Italy, Scotland, Northern Ireland, Ireland and Bulgaria. The response must cross those borders too. Specialist cyber-crime officers in Scotland are already working to identify the source; their Italian, Irish, Bulgarian and Northern Irish counterparts should be working the same problem with shared evidence and a common picture. The sender's advantage is speed and anonymity. The only way to close that gap is to make the investigation as borderless as the crime.

Accountability matters here precisely because the harm is real but the physical risk is low. If nothing is done, the lesson is that anyone can disrupt thousands of schools across three countries with one email and face no consequence. That is not a lesson worth teaching. The next step is for the police forces now investigating to say what they have found — and whether the 'Mikhail Andropov' signature leads to one sender or several.