One of the email addresses reported in the recent school bomb threats appears in our infostealer records with a compromise date of 1 October 2021. Five years later, the record gives investigators a date, associated services and device details to examine. Of the six reported sender addresses we reviewed, five appear in infostealer records and one in combo-list data. Our Telegram review also found separate posts encouraging threats and requesting bomb-making instructions.

The disruption is documented directly by an Italian recipient school, IIS G. A. Remondini, which published the threatening email it received on 11 November and described its evacuation. Hudson Rock subsequently reported historical credential exposure for two university addresses – f0523219@cloud.dyu.edu.tw and Mosaad_Khalifa@den.kfs.edu.eg. We expanded the review to additional reported senders, BAR0125@tlsc.vic.edu.au and jorhaida.budiang@r11.deped.gov.ph, and Telegram activity.

Old exposures behind newly reported threats

For the Egyptian university address, our records show credentials associated with Microsoft sign-in pages and a Windows 7 computer, dated 1 October 2021. Other education-service credentials were present in the same computer’s records. The platform’s discovery date, 14 July 2026, is separate from the recorded compromise date.

Figure 1. The Egyptian account’s device record shows a 2021 compromise date and a 2026 discovery date. “Other” means the malware family is unknown in ParanoidLab’s classification. Source: ParanoidLab.

The exposure extends beyond the Microsoft sign-in credentials. The same computer’s records contain logins for university learning and education-service portals, all dated 1 October 2021. An investigator can use these entries to identify which other services appear in the device’s exposure history and decide where further checks are needed. Unrelated personal details remain masked in the screenshot.

Figure 2. Other education-service credentials from the same computer carry the 1 October 2021 compromise date. Source: ParanoidLab.

The Australian education address reported in the Rieti threats also appears in an infostealer record. Its associated device is a MacBook Air running macOS; the same computer’s records include further education and personal-service credentials. Its compromise date is unknown.

Figure 3. Device details associated with the Australian education account. The record identifies a MacBook Air and macOS; private device and network details remain redacted. Source: ParanoidLab.

The account list includes Apple, gaming and learning-service entries alongside the education credentials. It shows that the captured data covers both educational and personal services. That is useful context for assessing the device’s exposure, although it does not show whether the people sending threats accessed any of those other accounts.

Figure 4. Education and personal-service credentials appear in records associated with the Australian device. Unrelated identifiers remain redacted. Source: ParanoidLab.

A Philippine education address visible in reporting on the next day’s threats appears in records dated 7 February 2024 and 24 March 2025. The earlier capture is classified as RedLine; the later family is unknown. This establishes repeated exposure of the account across separate dates.

Figure 5. The Philippine account appears in infostealer records with two compromise dates. Microsoft sign-in URLs are among the recorded services. Source: ParanoidLab.

The two device records preserve details that would be lost if an analyst saw only the latest entry. Both describe Windows 11 systems in the Philippines, but show different operating-system versions. The earlier record names RedLine, while the later family is unknown. Together with the separate dates, these details give investigators two captures to compare when examining the account’s repeated exposure.

Figure 6. The two device records preserve separate compromise dates. “Other” in the later record means the malware family is unknown. Source: ParanoidLab.

For the Taiwanese university address, our starting point was a set of combo-list entries that included Microsoft sign-in URLs. These records place the reported sender address in exposed credential data, although this source alone does not identify the malware or collection method behind the original exposure.

Figure 7. Combo-list records for the Taiwanese university address include Microsoft sign-in URLs. Passwords remain masked. Source: ParanoidLab.

We then searched for matching passwords and found entries for the university’s portal and other services. Those results give an investigator additional records to examine alongside the original email address. A shared password alone does not establish that every returned account belongs to the same person, so each link needs separate corroboration.

Figure 8. Results of the reverse-password search include university and other service entries. Personal identifiers remain masked. Source: ParanoidLab.

The earlier Bulgarian incidents show a similar overlap. NOVA and TrafficNews identified info@dealu.it and pierino.greco@astecosrl.it in June 2026 threat reporting. Both appear in our infostealer-sourced records, including Aruba webmail entries. The latter record is dated 16 April 2026; the former has no known compromise date. These are separate incidents, with no common operator established here.

Figure 9. Infostealer-sourced records for info@dealu.it include several Aruba webmail entries. Its compromise date is unknown. Source: ParanoidLab.

The second address has a dated record. Its 16 April 2026 compromise predates the June reporting, providing a specific point on the exposure timeline.

Figure 10. A sender address reported in the June Bulgarian threats appears against an Aruba webmail URL in a record dated 16 April 2026. Source: ParanoidLab.

A five-year-old record can still matter to a current investigation. It documents exposure history and associated services. These screenshots do not establish that the captured passwords remained valid, that access continued uninterrupted, or that those particular credentials were used to send the threats.

The account owner can be another victim

A stolen account can carry its legitimate owner’s name into messages they never wrote. Our concern is that an innocent person could face suspicion or reputational harm because someone else misused their account. That is a possible consequence, not a finding about these individuals. The evidence reviewed here identifies exposed accounts, not the people who operated them when the threats were sent. We have therefore withheld unrelated personal records and preserved redactions in the evidence.

Telegram reveals encouragement and further threats

On 12 November, one recorded Telegram sender ID posted to four groups within 2 minutes 11 seconds. Three messages used identical Persian wording suggesting that others imitate the reported Italian incidents and get their school closed; the fourth was a shortened version. This is evidence of repeated encouragement, with no evidence in the exports that anyone carried it out.

The chat and message identifiers preserve where the posts appeared, while the sender ID links the four posts in the export. Investigators can use those fields to follow the repetition across groups without mistaking each appearance for a separate report of an incident.

A separate Russian-language message on 10 November asked for instructions to make a pipe bomb and stated that it would be taken to school. No actual instructions appear in that record. Another post invited private discussion about “resolving” a school-threat issue, wording too ambiguous to classify as a confirmed criminal service.

Following the Telegram account into historical records

The bomb-making request was recorded under Telegram user ID 1477906800 and username MWEMX. Searching our historical datasets produced a Telegram-labelled record matching both identifiers, with account-history fields. The match connects the post to an earlier record of the same Telegram account and gives investigators a lead for further corroboration.

Figure 11. The historical Telegram record matches the posting account’s numeric ID and username. Other identifying details remain redacted. Source: ParanoidLab.

This is an account-level match, not a verified real-world identity. We are prepared to share the underlying evidence privately with law enforcement. The Telegram posts have not been linked to the operators behind the European threat emails.

The wider exposure in education

To put these cases in context, we researched education-related credential exposure in our database over the last 90 days. We found an estimated 76.7 million records matching selected education-domain patterns, with a returned total of 76,693,207. These are records received during that period, across our data sources; they do not represent 76.7 million people or new infections.

The scale of the result makes education-related exposure a priority for continued monitoring in our assessment. The examples above show why the history behind a record matters: an address can appear in an old capture, recur at a later date, or sit alongside other exposed services on the same device.

Data that supports other platforms and investigators

Our goal is to equip platforms and investigators with high-quality threat intelligence data they can assess and use in their own tools. The records need to retain their origins, relevant dates and associations, so analysts can judge each connection against the evidence available to them.

These cases show what that data contributes. The infostealer records document exposure histories and associated services. Telegram adds statements tied to specific messages and accounts, while historical datasets can provide earlier account context. Investigators can compare these records with their own evidence, corroborate the connections and decide what warrants further action. Our contribution is to supply the data that supports those decisions.

Support for schools and universities

We recognise how difficult procurement and limited budgets can make it for schools and universities to obtain a service like ours. As part of our social responsibility, ParanoidLab has always been open to supporting these institutions free of charge. Schools and universities facing these barriers are welcome to contact us.

Evidence and methodology

The article combines public incident reporting with ParanoidLab’s supplied credential screenshots, four Telegram exports, historical account records and a reported database query result. A published sender address is an indicator for investigation; it does not by itself authenticate the sending session. Compromise, discovery and dataset-loading dates are distinct. The Taiwanese finding is classified here as combo-list exposure. “Other” means an unknown malware family.

The Telegram exports contain 3,406 distinct messages after deduplication by chat and message ID. Only 43 of 691 reply messages have their parent included, limiting interpretation of intent and context. Statements are reported as observed; no connection to completed violence or the European email operators is established.

Sources

[1] IIS G. A. Remondini. Una mail dal Misoginistan. Updated 11 November 2026. Recipient school statement, published sender address and evacuation account. School statement

[2] Hudson Rock. School Bomb Threats: Hudson Rock Finds Reported Sender Accounts in Infostealer Data. 12 November 2026. Earlier findings for the Egyptian and Taiwanese addresses; the Egyptian threat-address linkage is reported rather than independently authenticated here. Hudson Rock report

[3] ParanoidLab original evidence. Credential and device screenshots 1–13 supplied on 12 November 2026. Taiwan: 1–2; Egypt: 3–5; Australia: 6–8; Philippines: 9–11; older Italian sender addresses: 12–13. Device associations and search provenance supplied by the research team. Selected redacted excerpts appear in Figures 1–10; additional originals are retained by ParanoidLab.

[4] Euroroma. Allarmi bombe nelle scuole. A Roma e nel Lazio più di 50 gli istituti sgomberati. 11 November 2026. The Rieti passage publishes the Australian education sender address. Incident report

[5] L’Indipendente. La mail inviata alle scuole e al governo. 12 November 2026. Published email screenshot displaying the Philippine education address; its PDF reproduction was retained and visually checked during research. Published reproduction · PDF

[6] NOVA. Сигнали за бомби в над 70 училища в цялата страна. 2 June 2026. Publishes info@dealu.it as the reported sender. Bulgarian incident report

[7] TrafficNews. Бомбени заплахи из цялата страна: Под прицел са летище, болница и училища. 4 June 2026. Publishes pierino.greco@astecosrl.it and distinguishes the earlier info@dealu.it messages. Bulgarian incident report

[8] ParanoidLab Telegram export review. Four messages on 12 November 2026 with the same fromUserId, 8779591066, span 131 seconds; the first three texts are identical. Message text and metadata are preserved in the supplied exports. The fourth link is restricted. Corpus totals and reply coverage are calculated from the four exports; live link availability is not guaranteed. Post 1 · Post 2 · Post 3 · Post 4

[9] Telegram export record. FootCardChat message 3094817, 10 November 2026. Recorded sender ID 1477906800, username MWEMX. The Russian text requests bomb-making instructions and states a school destination. Its parent message is absent; no instructions or completed act are evidenced. Message reference

[10] Telegram export record. USHUGUR message 106438, 12 November 2026. Invitation to discuss a school-threat issue privately; context is insufficient to determine whether it offers criminal assistance. Message reference

[11] ParanoidLab original evidence. Corrected screenshot 14(2).png and detail screenshot 15.png. A Telegram-labelled dataset record matches both social_network_id 1477906800 and username MWEMX. The search result displays four items, but this article relies only on the visible corroborated account record. No verified real-world identity or phone association is claimed.