Surge in Bomb Threats to U.S. Schools This Week

Current Analysis of Indicators

Indicators of Potential Foreign Influence

Several factors could make foreign involvement more plausible, though no open-source reporting connects the threats to Iran or its proxies. Prior U.S. government warnings of low-level cyberattacks and hoax threats in the U.S. from conflict in the Middle East, this week’s warning of an increased threat to Israelis and Jews abroad from Israel’s National Security Council based on the October 7 anniversary of Hamas’ attack on Israel in 2023, and two states‘ prior acknowledgement of foreign-based threat callers to schools after the start of the war serve as indicators of a heightened possibility of foreign-influenced action.

On September 25, the U.S. Department of Education (ED) and Department of Justice (DoJ) issued guidance for schools on anonymized threats based on an increase in swatting incidents. While federal agencies previously issued guidance and organized resources in response to bomb threat campaigns, Concentric did not identify a similarly issued joint statement between the ED and DoJ, suggesting a timely need for guidance within an elevated threat environment.

Missing Indicators of Foreign Influence

Reasons for foreign action remain unclear, as both the symbolic retaliation around the October 7 anniversary and upcoming midterm elections provide distinct motivations and goals for bomb threats. However, no Jewish or Israeli sites were impacted, no one has claimed responsibility for the threats, and no credible attacks have occurred in tandem with hoax threats to indicate there is a strong correlation between this week’s bomb threats and foreign-actor influence. Concentric also did not identify deep and dark web discussion about bomb threats in extremist or hacktivist chats suggesting foreign influence-led activity.

Indicators of Ransomware Group Retaliation

Recent U.S. government actions against ShinyHunters, including the detainment of a suspected member last week, produce a separate potential catalyst and form of threat actor responsible for this week’s bomb threats. The suspected ransomware group member is reportedly cooperating with law enforcement, which provides motivation for other ShinyHunters group members to retaliate against law enforcement following their initial defacement of the Federal Bureau of Investigation’s (FBI’s) website and claims of stealing sensitive information about FBI employees. Given the absence of credible bomb threats in this week’s clustered activity and the proximity to the member’s reported cooperation with law enforcement, ShinyHunters members represent a separate potential threat actor responsible for this week’s events.

Recent Bomb Threats to U.S. Schools

This week, multiple states responded to bomb threats impacting schools across the U.S., including Virginia, Pennsylvania, New York, Ohio, Michigan, Florida, and California. Out of more than 20 incidents in seven states, law enforcement did not identify any bombs. Most incidents impacted several schools at once, and one fast food location was also targeted.

Monday, October 5
- Erie, Pennsylvania: Around 1:30pm, swatting calls claimed bombs had been placed at Strong Vincent Middle School, Cathedral Preparatory School, Mercyhurst University, and a Dairy Queen. Strong Vincent went into secure status, and Mercyhurst quickly recognized the calls as swatting. Police swept the sites with K-9s and found nothing.
- Ann Arbor, Michigan: Slauson Middle School received a bomb threat after most students had left for the day, and police evacuated those still inside. Ann Arbor Open got a similar threat around the same time. Neither threat had specific details, and both were ruled not credible.
- Southern Ohio: Separate bomb threats closed Pickaway-Ross Career Center and delayed Waverly City Schools by two hours. Waverly had already canceled classes over a bomb threat on Sept. 17.
Tuesday, October 6
- New York City, New York: At 8:44am, a caller claimed a pipe bomb was in a bookbag at Robert Wagner Middle School on the Upper East Side. Similar threats impacted J.H.S. 157 in Queens and I.S. 201 and I.S. 239 in Brooklyn. Police said other schools in Brooklyn and Queens got similar calls, with all incidents cleared and no arrests.
- Philadelphia, Pennsylvania: The district confirmed bomb threats at a few of its properties and evacuated Masterman. Baldi Middle, Spruance, Hill-Freedman World Academy and Rhodes went into brief lockdowns, all lifted by early afternoon.
- Reading, Pennsylvania: Reading High School evacuated around 2:27pm and canceled after-school activities. The district had a separate weekend bomb threat that turned out to be unfounded.
- Bellaire, Ohio: A student found a threat written on a bathroom wall, and the school went into internal lockdown. It was ruled non-credible by about noon and was the school’s second bomb threat this school year.
- Fair Oaks, California: California Montessori’s American River campus locked down and dismissed students early after a threat around 1:00pm. Deputies with bomb dogs found nothing and called it a hoax.
- Palm Bay, Florida: A caller reported a bomb at a school without saying which one, prompting extra police presence at Palm Bay schools. Police later described it as an attempted swatting.
Wednesday, October 7
- Central and Southwest Virginia: ABC13 Lynchburg reported multiple school divisions in the area received bomb threats this morning.
  - Amherst County: Every school went to secure status after Amherst Middle received a phoned-in bomb threat. The status was lifted after searches found no danger.
  - Altavista Combined School: The school was evacuated after they received an automated threat.
  - Franklin County: A threat call aimed at Franklin County High put seven facilities on lockdown or hold. The lockdowns were lifted once the threat was deemed unsubstantiated.
  - Lynchburg: Heritage High and Heritage Elementary were briefly placed on hold, with the secure status since lifted.

How Concentric Can Help

Active Monitoring

Concentric continuously monitors geopolitical developments, state-linked activity, organized crime, cyber threats, concerning online activity, and other developments that could affect executives, employees, facilities, travel, events, or business operations. Our analysts identify emerging threats, assess their potential impact, and provide timely alerts and escalation where appropriate.

Corporate Security & Threat Assessments

Concentric assesses how geopolitical developments and state-linked criminal activity could translate into risks for businesses, such as espionage, cyber intrusion, surveillance, intimidation, sabotage, and targeting of personnel or facilities. These assessments help organizations identify vulnerabilities and strengthen security measures before threats materialize.

Executive Risk Assessments

Our analysts assess an executive’s exposure to state-linked and non-state threats, considering factors such as public visibility, decision-making authority, government relationships, sensitive information, international travel, personal accessibility, and links to politically sensitive issues or regions.

Executive Protection

Concentric provides residential security assessments, advance planning, secure transportation, travel security, counter-surveillance support, and scalable protective services for executives and other high-risk personnel. Support can be deployed during periods of heightened geopolitical tension or incorporated into ongoing executive security planning.

Protecting Personal Information

Eclipse by Concentric™ removes unwanted personal information which may expose executives, family members, residences, staff, personal accounts, or travel patterns.