Exclusive:School attendances fall in wake of hoax bomb threat as experts warn of 'copycats'
Calls for centralised national reponse to similar threats
Several Scottish local authorities said school attendance levels were lower than expected on Tuesday in the wake of the nationwide hoax bomb threat scare.
The number of pupils attending schools across the City of Edinburgh Council was below what it would expect for the time of year, and it has urged parents to speak to their children to “calm their fears” following the incident.
Glasgow City Council said it too had seen a drop in school attendance, with the figure as low as 50 per cent in some establishments. Its overall average attendance rate for 2025/26 was 88.7 per cent. East Dunbartonshire council said it saw a “slightly higher than expected” number of absences on Tuesday.
It comes as some experts warned there would likely be some copycat hoax incidents, while others said there was a need for a more centralised response, instead of asking individual councils to take the lead.
Edinburgh was one of several council areas in Scotland which had an in-service day on Monday, but it took the decision to evacuate staff from school buildings after receiving the email threat.
Councillor James Dalgleish, its convenor of education, children and families, said: “I want to stress that we have worked with police as well as following our own safety policies and we established there was no risk to pupils.
“Attendance is crucial for our learners and I would urge parents to speak to their children and calm their fears. If you have any concerns about attending, please speak to your child’s school. School staff will also be checking in with pupils to make sure they are safe and supported.”
Authorities in Glasgow have also issued new communications to parents, and said it would continue to reassure families.
Police Scotland said it received more than 300 calls after details of the threatening messages emerged, with concerned parents also navigating swathes of misinformation across social media. The force said it was continuing to investigate the incident, and was treating the messages as a hoax.
However, some parents and carers have also criticised the response from authorities, pointing out that some councils did not notify them about the incident until mid-afternoon on Monday.
Dr Daniel Thomas, senior lecturer in computer and information sciences at the University of Strathclyde, told The Scotsman that communication was a “challenge” in schools with overworked staff, limited resources, and delays in getting information they were confident enough to share.
He said: “Some schools may have thought that sending out a notice during school hours might only have made the situation worse by causing parents to become aware of the situation and then turn up at the school when the school did not have capacity to handle it. This then can cause an information vacuum and conspiracy theories fill such vacuums.”
Dr Thomas stressed that the “real risks” have not changed, and said that while Police Scotland needed to apprehend those responsible, the incident should be ignored once it is confirmed as a hoax. “We will likely see some copycats in the next wee while,” he added.
Megan Popescu, the founder of Kids in Cyber, an educational initiative that teaches digital literacy, online safety, and technology concepts, pointed out that just one email, sent to enough schools, was capable of causing an “enormous amount of disruption,” with some schools in Northern Ireland which were also targeted asking parents to “come immediately” to collect their children
She said that teachers and school staff had to make “difficult decisions” and even when a threat turned out to be a hoax, the disruption and distress remained “very real.”
She explained: “Digital threats can have very real consequences in the physical world. Schools need clear procedures for handling threatening communications, and staff need to know how to escalate them without creating unnecessary panic.”
Carla Baker, a member of the Scottish government’s National Cyber Resilience Advisory Board, and senior director of government affairs in the UK and Ireland at Palo Alto Networks, told The Scotsman that cyber threats were “increasingly sophisticated,” and operated at a scale that individual councils “shouldn’t have to tackle alone.”
She said: “We strongly support a centralised response led by the Scottish government, which would deliver crucial economies of scale, standardise security approaches across all local authorities, and provide every school with access to dedicated expert resources. Operating at a national scale allows for unified threat intelligence and automated real-time incident detection.”
Chris Gorman, a director of Glasgow-based AG Lockdown, an emergency response platform designed to help schools, hospitality venues, and public-facing institutions respond to terror-related or hostile threats, pointed out that “hundreds of different decisions” were made as a result of schools receiving the same email
He pointed out that the introduction next year of Martyn’s Law - the UK government’s response to the Manchester Arena bombing in 2014 to ensure that public places are better prepared for attacks - will ask every school to have robust policies in place.
The legislation, which is expected to come into force in spring 2027, will require schools to have public protection procedures addressing key issues such as evacuation, invacuation, lockdown, and communication.
With Police Scotland’s cyber and fraud unit continuing to carry out extensive enquiries to establish the source of the email, other experts said they expected a detailed digital forensic investigation would be underway.
“Normally, the email itself can contain additional information on the time it was sent and possibly the sender’s location,” said Bill Buchanan, professor of cybersecurity and applied cryptography at Edinburgh Napier University. “Often, though, these details will be obfuscated for a more advanced threat actor, but, for a less experienced person, there may be a way to trace the original source email address.”
Prof Buchanan said it was “not an easy call” when such incidents disrupted schools, but added: “I would expect there to be a cybersecurity incident response team in Scotland that will make a judgement on whether the risk is real or not.”
Comments
Want to join the conversation? Please or to comment on this article.