Security firm Hudson Rock said on 12 November that it found stolen-login records for two university email addresses linked to the bomb-threat emails of 11 November. One address is Egyptian. It matched a computer infected with Vidar, a program that steals saved passwords. That file is dated 1 October 2021 and holds 112 saved logins. The other address is Taiwanese. It appeared in AlienTXTBASE, a large collection of stolen logins. Hudson Rock dates that data to more than a year before the threats. ANSA reported that about 6,000 Italian schools got the messages, citing the Education Ministry.
Hudson Rock says it is not yet known whether these passwords were used to send the threats. It says mail and sign-in records from the providers are needed. It also says the old data does not prove the passwords still worked. The Egyptian address was seen in a newspaper photo and an X post. Hudson Rock notes that a sender address does not show who ran the account. Focus Taiwan reported that Da-Yeh University found an alumnus account had sent a large amount of email and seemed compromised. The university suspended it. The cause and the real sender are still under investigation.
Hudson Rock argues that the old records gave defenders a long window to lock down these accounts. It says a password reset alone is not enough. Teams also need to end open sign-in sessions and clean the infected computer. Anyone who runs company email can check staff logins against leaked-password lists.