Hybrid warfare without borders: How Europe’s schools, airports and food systems became targets

An estimated 6,300 schools in Italy received the same threatening email on Wednesday. More than 300 schools were evacuated as a precaution. As students and teachers waited outside, police searched classrooms and found nothing suspicious. Around 470 schools in Scotland and more than 300 in Northern Ireland received similar emails, while schools in the Republic of Ireland were also targeted. Police and intelligence agencies assessed the threats as hoaxes, but the disruption was real.

The choice of targets was deliberate. A threat against a school unsettles parents and educators far more than one against a warehouse, while demanding an immediate response. The toll was psychological as well as operational, with police hours and emergency resources diverted to investigate false alarms.

The threats against schools were part of a wider wave of disruption affecting Europe. Aviation was another sector badly hit. Between November 2 and 6, more than 50 passenger flights faced bomb threats. Among the affected services were flights operated by Aer Lingus, LOT Polish Airlines and Aegean Airlines. Airports and aviation authorities across Prague, Rome, Brussels, Paris and Sofia were forced to respond. Aircraft were diverted, grounded or evacuated, while fighter jets were scrambled to escort passenger planes through European airspace. An Aer Lingus flight travelling from Dublin to Rome, for instance, was escorted by French fighter jets and diverted to a military base. No explosives were found aboard the aircraft that were searched, but the response involved the mobilisation of substantial security resources.

The media and political establishments were targeted as well. Bomb threats forced evacuations at RTÉ, Newstalk and the Irish Independent in Ireland, Nova in Bulgaria and Sky News in London. Broadcasts were disrupted and studio staff evacuated. The mass emails sent to schools and newsrooms also carried personal threats against Prime Minister Giorgia Meloni. Separately, pro-Russian hackers published the personal data of Foreign Minister Antonio Tajani on the dark web. In a message accompanying the threats, the sender warned that this was only the beginning.

Then the attacks moved from inboxes to machinery. In France, hackers remotely manipulated temperatures in supermarket refrigeration systems, causing food to spoil on a large scale. Similar incidents were reported in several other European countries, prompting the European Union Agency for Cybersecurity (ENISA), the European Commission and Europol to coordinate their response. French authorities also disclosed an attempt to manipulate refrigeration systems at three sites storing plasma for the French Blood Establishment. Monitoring systems detected the intrusion in time, and the stored products were secured before any damage occurred.

The French government has attributed the refrigeration attacks to Iran’s Islamic Revolutionary Guard Corps (IRGC). Foreign Minister Jean-Noël Barrot said: “I am able to confirm that responsibility for this act lies with the Islamic Revolutionary Guard Corps.” Describing the incident as an attack of unprecedented scale and aggression, he said it constituted a major assault on France’s national interests and security. Tehran has rejected allegations of involvement in the broader cyber campaign. Meanwhile, hackers breached the company behind the Brenner Base Tunnel, the major rail link being built between Austria and Italy. Meloni has argued that hostile campaigns are increasingly targeting civilian infrastructure, making food preservation, healthcare supplies and essential services potential points of vulnerability.

An emailed bomb threat is cheap to send and relatively easy to conceal behind digital relays. However, aviation authorities and police cannot dismiss an unverified alert. If even one threat proves genuine, the consequences could be catastrophic. Security protocols therefore require aircraft to be grounded or diverted, runways inspected and airport perimeters searched. The perpetrators exploit precisely this asymmetry: the cost of sending a false alert is negligible, while the cost of ignoring a genuine one could be devastating.

Geopolitics provides an important part of the context, although the perpetrators behind the different incidents have not all been conclusively identified. European officials have increasingly pointed to Russia’s shadow campaign against countries supporting Ukraine, as well as cyber operations attributed to Iran. France has publicly blamed the IRGC for the attacks on refrigeration systems, while the investigation into the bomb threats and other incidents remains ongoing. The allegations against Moscow and Tehran have been denied by the countries concerned. It is also too early to conclude that every incident is part of a single centrally directed operation.

Italian Defence Minister Guido Crosetto offered a glimpse of the challenge facing governments when he described the threats as an attempt to spread fear and anxiety. “Given the tools and means available today, any one of us could send an email to a school, a kindergarten, or an airline claiming there’s a bomb,” he said. Meloni, after a meeting with senior ministers and security officials, sought to reassure families that the threats would not dictate the functioning of schools. “We won’t let an anonymous email decide our children’s school calendar,” she said.

The old distinction between external security and civilian protection has blurred. Italian leaders have argued that protecting refrigeration systems in blood banks, securing municipal networks and defending essential services must now be treated as matters of national security. Governments that once planned primarily for territorial defence must increasingly plan for the vulnerability of thermostats, supply chains, communications networks and transport timetables. They must also persuade voters to pay for protection of systems whose reliability has long been taken for granted.