(versione italiana qua)
Sending out, in a single day, an email that simultaneously reaches around 6,300 Italian schools is no easy task. The company that manages the email servers of the istruzione.it domain — and I know this from personal experience, being the coordinator of the Programma il Futuro project, in which virtually all schools in Italy take part — uses sophisticated mechanisms to monitor what gets sent to schools. When we send out, for example, the announcement of our annual competition (here is the one held in the 2025-26 school year), we spread the mailings over several days, and we had to configure our servers in a sophisticated way — thanks to the skill of our system administrators — in order to be accepted as trustworthy senders.
Moreover, most email servers have anti-spam filters that are nowadays backed by artificial intelligence techniques capable of blocking messages that are poorly written or that refer to non-existent facts or people.
So it really does seem that, in this case, something went wrong from a technological standpoint.
As for what in cybersecurity is considered the weakest link in the chain — the human factor — the thought is that if indeed, out of roughly 6,300 schools reached, only about 300 were evacuated, this means that all the training carried out in schools on digital citizenship has paid off.
Of course, that number is still too high, but it is nonetheless an encouraging sign. Hoping, it must be said, that the fact the other schools were not evacuated was not simply because nobody read the email all morning, which arrived a few minutes before 10 a.m.
It is essential to continue the work of digital citizenship education, a field in which I have been active for many years and for which the Programma il Futuro project has made a wealth of materials freely available to schools.
Returning to the technical side of things, imagine if, in a company with thousands of branches, the manager of each one received a similarly worded email demanding a prompt payment of a few thousand euros. Three hundred of them take the bait, and the company loses half a million euros in a matter of minutes. The fact that 5% of users fall for a phishing trap (the term for the phenomenon whereby carefully crafted email messages induce recipients to take actions they shouldn't) is a figure that — given the current state of general digital awareness — is still plausible. What is not tolerable, given today's information technology, is that nearly 80% of all 8,000 main school institutions in Italy were reached by an email of this kind.
Let us hope that the investigations the Postal Police will conduct, with the support of the ACN (Agenzia per la Cybersicurezza Nazionale: the national cybersecurity agency), will bring to light more information to prevent similar situations from happening again.
In the meantime, the Government did well, in confirming that there is no actual danger connected to these emails, to call for calm and reason, pointing out that the real goal is to create a climate of tension — and it is precisely this trap that we must be careful not to fall into.
PS: While I was writing this article, news came in of further threatening letters, a fact that does not change the substance of my reflections.
--The original version (in italian) has been published by "StartMAG" on 12 november 2026.
