Hudson Rock reports school bomb threat sender accounts in infostealer data

What happened

According to Hudson Rock, two university email addresses linked to the bomb-threat emails that reached schools on November 11 appear in its stolen-credential data. This is Hudson Rock’s own analysis, published on its InfoStealers site on November 12, 2026 Hudson Rock: School Bomb Threats: Hudson Rock Finds Reported Sender Accounts in Infostealer Data. The pipeline found no other outlet carrying these findings, and they have not been independently verified here.

What Hudson Rock reports:

• Egyptian university address: Hudson Rock says it matches a machine record classified as infected with Vidar, dated October 1, 2021. The record includes saved Microsoft sign-in credentials. Hudson Rock says the browser-password export holds 112 credential records, 20 of them using that address, and that the export shows password reuse across services.
• Taiwanese university address: Hudson Rock says it found a matching Microsoft credential entry in AlienTXTBASE, a collection of aggregated infostealer data. It dates that data to more than a year before the threats. The article says the university reported abnormal bulk sending and suspended the account.

For context, Hudson Rock cites ANSA as reporting that approximately 6,000 Italian schools received the messages, citing the Education Ministry. It also says Northern Ireland police reported more than 300 schools received the same message. These figures are Hudson Rock’s relay of other outlets and were not checked against those outlets here.

What is not confirmed, according to the same article:

• Hudson Rock says authentication and mail-delivery records from the providers are needed to determine whether these credentials were used to send the threats.
• It says an apparent sender address does not establish who operated the account, and the legitimate holder should not be treated as the author.
• The files reviewed do not establish session-token theft or an MFA bypass in either account.
• The “Unresolved” label in Hudson Rock’s interface is not proof the Egyptian password was still usable in 2026.
• The findings do not establish a common operator, or an infostealer link, for every threat sent that day.
• The sender name in the emails is a claim made by the sender, not verified attribution.

Am I affected?

The source describes only these two university accounts. Nothing in it says other organizations were compromised. Hudson Rock says the records do not prove a breach of Microsoft’s infrastructure.

The general point Hudson Rock draws applies to any organization with email accounts: credentials saved in a browser on an infected computer can be exposed, and old exposure can matter later. Whether your accounts appear in infostealer data is not confirmed by this source and needs checking against an exposure-monitoring service.

What to do now

1. Check your organization’s accounts against an infostealer exposure source. Hudson Rock says the exposure in this case predated the threats, by more than a year for the Taiwanese address and by about five years for the Egyptian record.
2. Reset passwords for any account found in such data, including accounts where the same password was reused on other services.
3. Revoke active sessions for those accounts. Hudson Rock notes that replayed session tokens can give access after MFA has been completed.
4. Review sign-in activity and outbound mail for those accounts. Hudson Rock says that earlier exposure monitoring, credential replacement, session revocation and closer scrutiny of sign-ins and outbound mail could have been used before abnormal bulk sending began.
5. If you are investigating a specific message, keep the original email with full headers and request provider message traces. Hudson Rock says these can help show which identity, application or session submitted the mail.

Sources

• Hudson Rock: School Bomb Threats: Hudson Rock Finds Reported Sender Accounts in Infostealer Data