More than 1,800 Italian schools received hoax bomb warnings on Thursday, but most of them stayed open, after the government told schools to stop clearing buildings unless there is concrete evidence of danger.

The second wave of threatening emails came a day after a similar message reached about 6,300 schools across Italy on Wednesday, triggering evacuations and panic among parents. No explosives were found in any school.

On Thursday, 1,803 schools received the threats, according to Reuters. Some were evacuated, but hundreds of schools chose to ignore the warnings or reopened quickly under the new guidance from Prime Minister Giorgia Meloni's government.

New guidance keeps classrooms open

Meloni's office said public buildings should be cleared only if there is concrete evidence of danger, after Wednesday's mass evacuations disrupted lessons across the country.

"Buildings should not be evacuated in the absence of concrete elements beyond the mere receipt of a mass email that would suggest a genuine danger exists," the prime minister's office said.

As the alarm spread for a second day, Meloni summoned opposition leaders to her office for talks on how to handle similar incidents, and announced plans for a protocol aimed at limiting their impact.

After the two-hour meeting, opposition leaders said it was up to the government to come forward with proposals, but criticised Meloni over what they described as inadequate investment in cybersecurity.

A second day of threats

The warnings on Thursday were again signed by "Mikhail Andropov" and included another threat against the prime minister, who was also targeted on Wednesday.

Italian media reported that the emails were sent from a compromised university account in Taiwan. Prosecutors in Genoa have opened an investigation into causing a false alarm, disrupting a public service and making serious threats, possibly aggravated by terrorist intent.

The ANSA news agency reported that early leads point towards Moscow, although investigators have cautioned that this could be deliberate misdirection. Some European officials suspect Russia may be behind a campaign of disruption against countries supporting Ukraine, but Italian officials have said there is no evidence of that so far, and Russia denies involvement.

Russia's ambassador to Italy said on Thursday that the Russian authorities were ready to help their Italian counterparts track down whoever was behind the threats.

Opposition turns on cybersecurity spending

The opposition used the meeting with Meloni to accuse the government of prioritising spending on conventional military equipment while neglecting cyber defences.

"How has the money been spent so far? Yesterday's alarm could have been dealt with using a good antivirus programme," said former Prime Minister Matteo Renzi, leader of the centrist Italia Viva party.

Elly Schlein, leader of the main opposition Democratic Party, said Italy needed stronger coordination among the bodies responsible for cybersecurity, and proposed shifting part of the available resources towards cyber defences.

Nicola Fratoianni of the Green-Left Alliance said opposition leaders had asked the prime minister why, in Ireland, the authorities had warned schools in advance and told them to remain open because the emails were not considered a threat.

A wider European pattern

The school threats are the latest in a series of hoaxes and cyberattacks that have recently targeted supermarkets, blood banks, air traffic systems and broadcasters across Europe.

Authorities in Scotland, Northern Ireland and the Republic of Ireland said many schools there had received similar threatening emails from abroad, but classified them as hoaxes and allowed classes to continue.

Italian investigators are now working with European partners to identify those responsible, as the government draws up new rules designed to stop a mass email from closing thousands of schools again.