6,300 Emails, 300 Evacuations: What Europe’s Hoax Wave Costs the Defender and Why Attribution Is the Contested Ground

1. The Facts as Reported

Threatening emails reached an estimated 6,300 schools in Italy on 11 November, with mass evacuations ordered in cities including Rome, Milan, Naples, Palermo and Bologna, and no explosives found. [Established — CBS News, 11 November 2026.] Al Jazeera put the number evacuated at no fewer than 300; hundreds of schools in Ireland and the United Kingdom, including in Scotland and Northern Ireland, received similar messages. [Established — Al Jazeera, 11 November 2026; Euronews, 11 November 2026, headline-level for the Ireland and UK element.] CBS describes the wave as the third in a month to hit Italian schools, after 19 October and 2 November. [Established — CBS News, 11 November 2026.]

The emails were signed by “Mikhail Andropov, leader of the Vilayat of Misoginistan” — a name CBS reports belongs to a Russian misogynistic extremist group banned in Moscow years ago — and said an explosive device had been planted in Meloni’s car; one read “We have come to annihilate you.” [Established — CBS News, 11 November 2026; Al Jazeera, 11 November 2026.] Police Scotland described the messages as hoaxes and opened a cyber-unit inquiry; the Northern Ireland Education Authority said police did not regard them as credible and noted similarities with an earlier hoax in October. [Established — Al Jazeera, 11 November 2026.]

The schools sit within a wider pattern. More than 20 European commercial flights received fake bomb threats on 5 November, [Established — CBS News, 11 November 2026] with a later report describing more than 50 flights affected between 2 and 6 November, aircraft grounded or diverted and fighter jets scrambled. [Assessed — The Week, 12 November 2026, as indexed by search; the Desk did not open the article, and the figure is higher than CBS’s.] Cyberattacks have also hit supermarket refrigeration systems in Germany, Romania, the United Kingdom, France and Bulgaria, and, per CBS, blood banks in France. [Established — Al Jazeera, 11 November 2026 on supermarkets; CBS News, 11 November 2026 on supermarkets and blood banks.]

2. The Cost Asymmetry

The structural point is arithmetic. An email costs the sender close to nothing; a school evacuation costs the state teachers’ and pupils’ time, police and emergency capacity, parental alarm and, if repeated, public trust in the alert system. Sending to 6,300 schools and being answered by 300 evacuations is a favourable trade for the sender even if the success rate is under five percent. [Established for the counts — CBS News and Al Jazeera, 11 November 2026; the five percent ratio is arithmetic on the reported 300 and 6,300, noting that the two figures may not be measured the same way.]

Italy’s Education Minister Giuseppe Valditara drew the same conclusion when he said “it is clear that there is a strategy at play” and called the episode “a cyberattack rather than a genuine threat.” [Established — Al Jazeera, 11 November 2026.] He also urged against “alarmism,” saying the content of the emails made it clear that any concrete risk was virtually nonexistent. [Established — Al Jazeera, 11 November 2026.] The two statements together describe the defender’s dilemma. To call the emails a strategy is to treat them as hostile design; to call them non-threats is to refuse the alarm they were built to cause. The state has to do both at once.

MI5 Director General Ken McCallum, speaking in the same news cycle, said “Russia remains aggressor number one” and that Moscow operates “carefully to stay below the NATO Article 5 threshold.” [Established — CBS News, 11 November 2026.] That second phrase is the strategic logic stated from the defender’s side. Hoaxes, refrigeration hacks and scares do not trigger collective defence, yet they impose costs on the same societies that collective defence exists to protect.

3. Who Sent It: Two Attributions and One Denial Each

Attribution is unsettled in the open record. French officials suspect Iran, which rejected the accusation. Some European officials suspect Russia, which denies involvement. [Established — Al Jazeera, 11 November 2026.] Western authorities, per CBS, attribute broader sabotage efforts largely to Russia and Iran. [Established — CBS News, 11 November 2026.] EU foreign policy chief Kaja Kallas has said Russia is trying to scare Europe into winding down its support for Ukraine. [Assessed — Kallas statement as relayed by a search-indexed summary of coverage; the Desk did not open the primary report.]

Two features of this dispute are worth separating from the question of who is right. First, the existence of two competing attributions is itself informative. An attacker that wanted maximum confusion could not design a better outcome than French officials pointing one way and European partners another. Second, the signature — a fictional Russian-named group with a misogynistic label — is as consistent with a deliberate false flag as with a genuine extremist or an amateur hoaxer. The Desk does not assert which. [Speculative — the Desk does not know who sent the emails and no source opened today establishes it.]

4. The Sceptics’ Case, Steel-Manned

The most serious counter-argument is that Europe risks over-reading. Hoax emails to schools are not new; the Northern Ireland authority’s own comparison to an October hoax shows the pattern predates this week, and copycat and criminal senders exist in every country that has experienced such waves. [Established for the October comparison — Al Jazeera, 11 November 2026; Assessed for the copycat point.] Labelling every cluster of incidents “hybrid warfare” hands the label’s intended beneficiary a free victory: if the public believes a hostile power is behind every false alarm, the false alarms work whether or not a hostile power sent them. Meloni’s own phrasing was careful — no concrete danger indicated, investigations under way, a government meeting convened — and she characterised the emails as part of “a strategy aimed at causing alarm and concern.” [Established — Al Jazeera and CBS News, 11 November 2026.]

The sceptic’s case is strongest on attribution and weakest on pattern. Even if no single incident proves a state hand, the combination of flight threats, three school waves in a month, and infrastructure hacks across five countries is a pattern that Western services describe as deliberate. [Assessed — the Desk’s reading of CBS News and Al Jazeera reporting; no primary intelligence assessment was available.] Neither side of the argument is wrong; they are answering different questions.

5. What It Means for Institutions

The EU’s cybersecurity annual report was published on 11 November, the same day as the Italian wave, and the agency’s chief reportedly warned that after supermarket refrigerators it could be routers or home appliances. [Assessed — search-indexed digest of 11 November 2026; the Desk did not open the report or confirm the quotation.] The institutional problem is that the tools Europe has are built for distinct categories: criminal law for hoaxes, civil protection for evacuations, cyber agencies for infrastructure, NATO for armed attack. A campaign that deliberately straddles them can be answered in each category only at the cost of acknowledging the pattern in none. [Assessed.]

Bottom line: The email is cheap; the evacuation is not; and the argument over who sent it is a second front. Italy’s minister is right that there is a strategy and right that there is no concrete danger, and a government has to hold both. The sceptics are right that over-attribution rewards the sender. The Desk’s view is that the pattern is clearer than the author, and that the discipline Europe needs is to respond to the pattern without claiming to know the author before the evidence says so.