Compromised Philippine DepEd Email Accounts Used in Mass Bomb Threat Campaign Targeting Thousands of Italian Schools
MANILA, Philippines — Thousands of schools across Italy and other parts of Europe have been targeted by a series of mass-distributed bomb threat emails, with the latest wave reportedly traced to email addresses associated with the Philippine Department of Education (DepEd).
In November 12, an incident has raised cybersecurity concerns after multiple DepEd email accounts were reportedly used to distribute threatening messages to Italian schools, government offices and judicial institutions.
The messages, signed under the recurring alias "Mikhail Andropov," claimed that explosive devices had been planted inside buildings and demanded the immediate resignation of Italian Prime Minister Giorgia Meloni.
https://iili.io/nyzq6GV.png
https://iili.io/nyzBEKB.jpg
Initial findings from Deep Web Konek (DWK) identified at least four distinct DepEd email accounts allegedly abused in the campaign.
The latest incident followed an earlier wave of bomb threats on November 11, when approximately 6,300 Italian schools received threatening emails. Similar messages also reached educational institutions in Scotland, Northern Ireland and other parts in Europe.
The earlier messages reportedly originated from accounts associated with Thailand and Taiwan. A Taiwanese university subsequently reported that one of its alumni email accounts appeared to have been compromised and used to distribute the threats.
On November 12, another wave reached Italian institutions, this time originating from multiple email addresses using Philippine Department of Education domain, according to Italian media reports and preliminary investigative findings.
Initial reports cited approximately 1,803 affected schools. However, a later preliminary count from the Italian government's office, Palazzo Chigi, placed the number at approximately 3,778 schools, with 77 evacuations reported. Thirty-six schools subsequently resumed classes that same morning.
Italian authorities said the messages were substantially similar to those distributed the previous day and again carried the signature of "Mikhail Andropov."
In its independent threat monitoring, Deep Web Konek reported identifying at least four distinct DepEd email accounts allegedly used in the November 12 campaign.
One of the identified accounts was, reportedly assigned to a public school educator in Region XI, was identified as a transmission source for an Italian-language threatening email titled "MESSAGGIO D'ITALIA. SIETE IN PERICOLO" (Message from Italy. You Are in Danger).
According to the technical information reviewed by DWK, the message was transmitted at approximately 9:39 a.m. Central European Time on November 12.
The email claimed that an explosive device containing ammonium nitrate and nitromethane (ANNM), alongside metal fragments, had been planted inside a building. It also threatened Palazzo Chigi, the Italian government's headquarters, and demanded Meloni's resignation.
Italian media reports also identified Philippine educational email domains as originating points for the latest transmissions, with separate reporting mentioning a compromised school domain in Batangas City.
DWK emphasized that its findings came from external threat monitoring and analysis of the agency's exposed digital footprint. The identification of these accounts does not, by itself, establish who operated them or prove that DepEd's central email infrastructure was directly breached.
DWK's investigation also points to a potentially larger cybersecurity problem involving the exposure of DepEd-associated credentials. Based on its dark web telemetry, breach-monitoring intelligence and credential exposure tracking, DWK has identified more than 400,000 leaked records and credential exposures associated with DepEd domains since it began monitoring in October 2024, through November 2026.
https://iili.io/nyz9yCX.png
https://iili.io/nyzzeaV.png
These cumulative findings include records associated with consumer and corporate credential exposures across multiple DepEd subdomains, including:
- lis.deped.gov.ph
- lrmds.deped.gov.ph
- commons.deped.gov.ph
- training.deped.gov.ph
The cumulative figure reflects the organization's monitoring period and should not be interpreted as 400,000 unique individuals, confirmed active accounts or a single database breach.
More recently, DWK monitored approximately 118,000 credentials exposed or associated with infostealer infections between January and October 2026 across DepEd-associated digital assets.
These findings represent a substantial volume of credential-related exposure activity within a ten-month monitoring period.
Infostealer malware is particularly concerning because it can silently extract sensitive information from infected computers, including saved usernames, passwords, browser cookies, authentication sessions and other stored credentials. The collected information may subsequently be circulated through underground marketplaces, dark web channels and publicly accessible credential dumps.
DWK also reported observing increased credential-harvesting activity targeting DepEd-associated domains and other government domains before November 5, followed by the appearance of additional lists containing employee email addresses and passwords on underground and open-web channels in early November.
Nevertheless, the findings highlight the continuing exposure of DepEd-associated credentials and the potential risks posed by previously compromised accounts.
DWK assesses that credential harvesting, potentially involving accumulated data leaks and infostealer malware infections, is among the most plausible explanations for how the email accounts were accessed.
Credential harvesting involves collecting usernames, email addresses and passwords through techniques such as phishing, fraudulent login pages, malware infections and other unauthorized means. Infostealer malware, in particular, can silently extract saved passwords, browser sessions and authentication information from infected computers.
If valid government email credentials are exposed and remain active, unauthorized individuals may be able to access legitimate mailboxes and use them to distribute messages under authentic institutional email addresses. This can make malicious emails appear more credible and potentially allow them to bypass certain spam and sender-reputation protections.
The use of legitimate institutional accounts also complicates investigations because the apparent sender may not be the individual responsible for the messages.
However, this remains a threat assessment rather than a confirmed forensic explanation. Investigators must still determine whether the accounts were accessed through stolen credentials, session theft, compromised devices, email spoofing or another method.
In earlier phishing campaigns reported by Filipino netizens and local school divisions, compromised DepEd email accounts were allegedly used to impersonate financial institutions, including the Land Bank of the Philippines (Landbank).
https://iili.io/nyzzk8B.png
These messages reportedly contained fraudulent security notifications and malicious links intended to deceive recipients into providing sensitive information.
The similarities raise questions about whether previously compromised DepEd accounts, exposed employee credentials and infected devices have remained accessible to cybercriminals.
If the same accounts or credential sets are being reused across different campaigns, the problem may extend beyond the Italian bomb threats and could expose government employees, schools and members of the public to additional cyber threats.
The bomb threats are also being investigated within the context of a broader series of disruptive incidents affecting European institutions.
The reported timeline includes:
- November 6 onward: Threatening messages targeting European news organizations and commercial aviation services.
- November 11: Approximately 6,300 Italian schools received bomb threats, with similar messages reaching schools in Ireland, Scotland and Northern Ireland. A compromised Taiwanese university-associated account was reportedly involved.
- November 12: A new wave of threats was distributed through multiple Philippine-domain email addresses, including accounts reportedly associated with DepEd.
The recurring use of the "Mikhail Andropov" identity has led investigators and security analysts to examine possible connections between the incidents.
Some European officials and security analysts have discussed the possibility of a broader hybrid disruption campaign or cognitive warfare operation intended to spread fear, undermine public confidence and strain emergency response services.
However, authorities have not established the identity of the perpetrators or confirmed any government or state-sponsored involvement.
Following the widespread disruptions caused by the November 11 incidents, the Italian government instructed schools not to automatically evacuate buildings solely because they received mass-distributed threatening emails.
Under the guidance issued on November 12, school activities should continue unless there are specific and concrete indications of an actual danger. Local prefects retain the authority to order evacuations when circumstances warrant such action. The Rome Public Prosecutor's Office is investigating the threats, including messages received by schools in the capital.
Authorities are examining the originating email accounts and technical information to establish how the messages were distributed and identify those responsible.
No confirmed explosives or actual bombing incidents have been established in connection with the reported school threats.
The reported use of DepEd email accounts in an international bomb threat campaign demonstrates how compromised government credentials can create consequences beyond the institution originally affected.
Even without a confirmed compromise of an agency's central servers, individual employee mailboxes can become entry points for unauthorized access, impersonation, phishing and other malicious activities.
The findings from DWK's monitoring also underscore the need to address the broader issue of credential exposure and infostealer infections affecting government-associated digital assets.
Government agencies should consider implementing or strengthening the following measures:
- Immediately investigate and secure the identified email accounts.
- Reset potentially exposed credentials and revoke suspicious active sessions.
- Enforce multi-factor authentication across institutional email services.
- Review email login histories, forwarding rules and outbound message activity.
- Examine possible infostealer infections affecting employee devices.
- Monitor exposed credentials and investigate underground listings.
- Implement continuous monitoring for suspicious authentication and outbound email activity.
- Coordinate with the National Privacy Commission, relevant cybersecurity authorities and law enforcement where appropriate.
DepEd should also establish whether other agency accounts have been accessed or abused and determine whether any employee or institutional information was exposed.
For organizations receiving suspicious messages, preserving the original email, including its full technical headers, is important for forensic investigation. Screenshots and forwarded copies alone may not contain sufficient information to establish the actual transmission source.
Deep Web Konek continues monitoring the incident for additional compromised accounts, technical indicators and developments that may help establish the extent of the incidents.
SOURCES:
• https://www.theguardian.com/education/2026/nov/11/bomb-threats-hoax-schools-scotland-northern-ireland?hl=en-PH
• https://www.regione.vda.it/notizie/details_i.asp?id=555442&hl=en-PH
• https://pasqualepillitteri.it/en/news/32575/bomb-threat-email-1803-italian-schools-meloni-resignation?hl=en-PH
