Europe’s School Threats Exposed a Gap Between Alarm and Evidence

Europe’s School Threats Exposed a Gap Between Alarm and Evidence
Threatening emails sent to schools across Europe triggered evacuations and heightened security, but so far the public evidence points to disruption, not an identified bomber or a confirmed wider plot. The response is unfolding amid growing concern about hybrid attacks, while the reported scale of the Italian campaign varies sharply between accounts.

One report said at least 6,300 schools in Italy received threats, alongside hundreds in Ireland and the U.K.; another described about 300 Italian schools as affected, with the number expected to rise. The accounts agree on the central facts: schools were targeted, Italian authorities ordered precautionary evacuations, and no explosives or suspicious devices were reported. The difference in figures underscores how early accounts may capture different stages or measures of the campaign.

Officials have framed the emails as a threat to public confidence as much as physical safety. Prime Minister Giorgia Meloni called them part of “a strategy aimed at causing alarm and concern,” while saying there was no “concrete danger.” Education Minister Giuseppe Valditara, meanwhile, said similar threats had targeted other settings and that “it is clear that whoever is behind the emails has a ‘strategy at play.’” Neither statement identifies a perpetrator: investigations were continuing, and Italian officials were examining possible links to earlier threats against airlines.

That uncertainty matters. The broader report places the school emails against a backdrop of suspected sabotage and cyberattacks that Western officials have associated with Russia and Iran, but it does not establish that either country directed these threats. Ireland’s police deemed the messages not credible and advised schools there not to evacuate, illustrating a more restrained response than Italy’s. Across the accounts, the tension is clear: authorities must take coordinated threats seriously without allowing unverified attribution—or the disruption itself—to outrun the evidence.