Bomb alerts in Europe now affect classrooms. On November 11, 2026, Italian, Irish and British schools received threatening emails. This wave follows air disturbances, media evacuations and sabotages of commercial refrigerators. Their common effect is visible: interrupt daily life and install anxiety. Their connection to a single operation, conducted by the same sponsor, is not.
The rapprochement deserves better than just a catalogue of incidents. Ireland appears in several sequences: affected businesses, threatened thefts, evacuees and later targeted schools. The country hosts two major European meetings on 12 and 13 November. The Irish authorities refer to a possible destabilization campaign. However, they distinguish this assessment from the incomplete results of the surveys.
Bomb alerts in Europe to schools
In Italy, the day of November 11 begins with reports in many cities. The first announcements cover approximately 300 establishments. The Ministry of Education then reports about 6,000 institutions receiving the message. These numbers measure different realities: receiving an email, reporting a threat and evacuating a building are not equivalent operations.
Students leave classes in Rome, Milan and Bologna, among others. In Arezzo, children from Tricca primary school join Pertini Park. Controls mobilize security forces and disrupt family day. Giorgia Meloni states that no concrete danger has been identified and convenes a government coordination meeting. The massive nature of the consignment feeds the hypothesis of an operation designed to cause disturbance.
Italian Defense Minister Guido Crosetto puts these alerts in a context of hybrid threats. It also refers to the possibility of acts committed by individuals seeking to sow the disorder. This reserve is important. An accessible method can be used by an organized service, an activist collective or an isolated imitator. Repeating the process does not allow for a choice between these assumptions.
In Ireland, do not automatically evacuate
The Republic of Ireland is also experiencing a wide range of threatening messages this Wednesday. Institutions in Dublin, Limerick, Galway, Meath and Kildare are among the recipients. The Garda describes a generic communication and considers the threat to be uncredible. The Minister of Education, Hildegarde Naughton, relays the police assessment: schools do not have to evacuate on this basis alone.
However, local decisions have preceded or accompanied these instructions. In Meath County and Celbridge, Kildare, schools took the students out. It would therefore be incorrect to present the country as completely free from evacuations. The difference mainly concerns the doctrine announced: evaluate the message with the police rather than turn each reception into a general closure.
In Northern Ireland, a British territory separate from the Republic of Ireland, more than 300 schools report the same email. The North Irish police, the NHPI, treats the case as a hoax. She said the message came from outside the UK. This indication describes a shipment origin identified in the investigation. It does not designate a nationality, an intelligence service or a government.
The North Irish educational authority notes similarities with a threat of October. On 19 October, the police had already treated as a hoax a shipment targeting many establishments. Recurrence requires follow-up, but a textual resemblance does not alone establish that the two waves have the same authors. A message can be circulated, copied or used as a template.
In Scotland, Police Scotland also confirms mass mailings to mailing lists. His assessment does not contain a credible threat. The unit specializing in cybercrime and fraud seeks the origin of messages with its British and international partners. Local disturbances are reported, particularly on Skye Island. The continuation or resumption of courses remains a decision based on local audits.
The planes had opened another sequence
On 5 November, several European links had already received bomb alerts. Flight Aer Lingus EI402, between Dublin and Rome, had been diverted to the military base in Evreux. The 151 passengers and six crew members had landed safely. French fighters had accompanied the aircraft. The Wizz Air flight between Milan-Malpensa and Warsaw had reached Vienna instead of its original destination.
A Finnair aircraft from Helsinki had reached Rome-Fiumicino under military escort. Other threats involved flights to Bulgaria, the Czech Republic and Belgium. The checks had not established the presence of explosives in the devices mentioned by the end-of-day balance sheets. However, the diversions and inspections had had immediate material consequences.
As a result, not all bomb warnings in Europe result in airport closures or landings elsewhere. Some aircraft reach their intended destination. Others change roads or wait for checks. This distinction avoids turning a serious series of disturbances into a general paralysis of air transport. It also recalls that the answers depend on the assessment of each situation.
Messages sent to airports in Rome and Sofia called for « Male State ». This signature does not constitute an verified assignment. The existence of a Russian movement bearing this name does not demonstrate its involvement in these shipments. It shows even less an instruction from Moscow. A claim may seek to attract attention or direct suspicion to another actor.
The European Commissioner for Transport, Apostolos Tzitzikostas, had considered it premature to conclude a link between the incidents. This caution does not negate possible coordination. It means that operational reconciliations must be established through investigations, not only by the proximity of dates or by the vocabulary of threats.
Irish editorials targeted before summits
On 6 November, the threat had moved to several Irish media outlets. RTÉ had evacuated his campus from Donnybrook, Dublin. Newstalk and the Independent offices were also among the organizations concerned. Programmes had been assigned during the controls. RTÉ employees were then able to return to the buildings.
The Irish Government then described a coordinated campaign of disruption as probable. At the same time, he indicated that he did not know who was responsible for it or whether it was individuals or a centralized effort. These two elements must remain together. The political assessment of a common threat does not replace the identification of persons, infrastructures and potential donors.
The schedule explains the particular attention paid to these alerts. Dublin hosts the European Political Community on 12 November, followed by an informal meeting of EU leaders the following day. The Garda presents the planned device as its largest security operation. Repeated disruptions can complicate this preparation and increase pressure on services. The timetable alone, however, does not prove that the summits constitute the motivation of the authors.
Refrigerators: from digital to physical damage
The refrigerators mentioned in this sequence are not primarily domestic appliances. These are commercial or industrial systems, controlled by connected controllers. Changing their parameters can interrupt the conservation of food, impose the withdrawal of products and stop an activity. A computer intrusion can result in physical loss without a sabotager entering the store.
Two waves must be distinguished. On the night of October 11-12, a campaign hit refrigeration controllers at more than 700 French sites. Paris describes the destruction of goods, fire departures and damage estimated at tens of millions of euros. On 9 November, the French authorities attributed the operation to the cyber-offensive Shahid Kaveh unit, linked to the Iranian Revolutionary Guards.
This official assignment concerns a specific attack. It is accompanied by a diplomatic response: the Iranian ambassador is convened on 10 November, while Paris announces that it wants to propose new European sanctions. Tehran rejects the French accusations. It is therefore necessary to present both the attribution formulated by France and the Iranian challenge, without confounding them with a final criminal judgment.
A new wave hits European installations on the night of 1 to 2 November. Incidents are reported in Belgium, the Netherlands and Sweden. Ireland is also among the countries concerned. The SuperValu sign indicates that 13 of its 223 stores suffered an incident affecting a particular model of refrigeration system. Fresh and frozen products were removed from the sale.
Technical similarities make comparisons necessary. They do not automatically extend the October French allocation to all November incidents. Several attackers can operate similar equipment. Facilities that are exposed or insufficiently updated may have the same weaknesses in several countries, but not a single operation.
Blood: a separate target, with no announced health impact
The French Blood Establishment confirmed an incident involving a supplier of refrigeration equipment in early November. Three sites were involved. The body and the health authorities have not identified any health impact in the public information. The EFS does not report any loss of blood products. This point must accompany any presentation of the case: an attack on conservation facilities does not mean that dangerous products have been transfused.
An investigation was opened, according to judicial information released on 10 November. At this stage, no link was established with Iran in this case. Proximity to attacks on large distribution warrants verification. It does not justify merging responsibilities, victims or consequences into a single balance sheet.
A real asymmetry, a coordinated war to be demonstrated
Asymmetry first appears in the relationship between the means involved and the costs imposed. An email can trigger a chain of checks, engage police officers, interrupt courses, or change a flight plan. The consignee must take into account the risk, even when the consignor has placed no explosives. The effectiveness of the threat lies precisely in this precautionary obligation.
Refrigeration sabotage follows a different logic. It requires technical access and changes the operation of a facility. The result can be destructive. Instead, the hoax operates a security procedure and the uncertainty it must manage. Bringing these two processes together under the expression of hybrid war illuminates their possible effects. This does not demonstrate that they belong to the same chain of command.
The psychological dimension is manifested in the anticipation of the next incident. A family may question the opening of the school, a traveller on his/her flight, an employee at his/her place of work. Repetition broadens concern beyond those directly affected. A company may be subject to this pressure even when the controls regularly conclude that there is no explosive.
To describe this effect does not mean to say that each author pursues a geopolitical objective. Isolated hoax, personal intimidation and organized surgery can cause similar reactions. To talk about a state campaign, we need more: converging technical elements, documented responsibilities and, when the authorities formulate it, an allocation whose scope remains precise.
A case documented in Schiphol illustrates the need to distinguish cases. On 5 November, a 45-year-old passenger was arrested for a false alert he allegedly made orally at a boarding gate. His flight to Prague was delayed. The Dutch military police confirmed his release the next day. No link to other European alerts was established in the information published on this episode.
Investigations must therefore consider several levels. Are school messages connected? Do they share infrastructure with airlines or the media? Are refrigeration incidents the same operators as the French campaign in October? Answering a first question does not automatically resolve the following.
Limiting disruptions without trivializing threats
Irish and British guidelines show a possible response to this pressure: centralizing the assessment and avoiding automatic evacuations based solely on a generic message. This method does not require schools to ignore a threat. It aims to make the decision dependent on available information and police work, rather than on the sender’s sole will.
For the cold chain, the response is through access protection, updates and control of exposed equipment. The Swiss Cyber Security Office recalls on 10 November that these systems can store food, medicines and other sensitive products. Reducing their exposure and checking their functioning after an incident responds to a concrete risk, regardless of the final outcome of the assignment.
Public communication also counts. To say what has been found, what has not been found and what is still in progress helps to reduce uncertainty. To announce an alert as a avoided explosion, or an email signature as state proof, would instead add to the confusion. On 11 November, the central question remains: what links will investigations establish between these operations, beyond their common capacity to disrupt daily life?
Cover: photo of the Convito Nazionale de Reggio de Calabria, March 2010. Illustration without a link between this institution and related events. Whole photo preserved. Franc rc / Wikimedia Commons, public domain; Libnanews dressing.
Comments