Schools across Scotland received threatening emails on Wednesday, 11 November 2026, and some schools in Edinburgh were briefly evacuated as a precaution. Police Scotland has said the messages are hoaxes, that there is no credible threat, and that there is no requirement to evacuate schools or keep children away from lessons because of the emails.

The disruption affected around 470 schools, according to reports, but police and councils moved quickly to reassure parents that pupils were safe. Here is what happened, what the emails said, and what parents should do.

What happened on 11 November 2026?

On the morning of Wednesday, 11 November 2026, threatening messages were sent by email to schools in Scotland and across the UK. Police Scotland said the messages were immediately assessed and are being treated as hoaxes. The force said its enquiries had established that there was nothing to suggest the messages represented a credible threat or that there was any wider threat to the public.

Some schools activated their emergency procedures when the emails arrived. In Edinburgh, St Augustine's, Broughton and Currie High Schools were among those evacuated as a precaution, and pupils were sent home from some schools. In the Highlands, Invergordon Academy told parents it would close for the rest of the day, and Nairn Academy was also evacuated. Police were seen outside Park Primary School in Dumfries and Galloway.

Other areas were less affected. Glasgow City Council said its schools had not been evacuated, and its executive director of education, John McGhee, said police had confirmed the emails were a hoax and that schools should not be evacuated.

How many schools were affected?

Around 470 schools in Scotland received the threatening email, according to reports on 11 November 2026. The messages were distributed through mailing lists used by schools across the UK, and Police Scotland said threatening messages were also sent to schools elsewhere in the UK.

Not every school that received an email evacuated. Police advice was clear: there was no requirement to evacuate classrooms or to keep children away from education based solely on the content of the emails. Schools that did evacuate did so briefly as a precaution while the messages were assessed, and pupils in Edinburgh were reported to have returned to classrooms after short precautionary evacuations.

Why were some schools evacuated if it was a hoax?

Schools evacuated before police had finished assessing the messages. When a school receives a threat mentioning a device, its first duty is to the safety of pupils and staff, so emergency procedures are triggered while the threat is checked.

Police Scotland assessed the messages immediately and concluded they were not credible. Once that assessment was shared, councils told schools there was no need to evacuate. Glasgow City Council, for example, passed on the police advice that schools should not be evacuated, while the City of Edinburgh Council said its schools had been evacuated briefly as a precaution and that police had since confirmed the threats were not credible.

What did the emails say?

The emails carried the subject line "DEATH IS NEAR" and were sent under the name Mikhail Andropov. The sender claimed to be the leader of a group called the "Red Owl" project and threatened to carry out a "genocide" against the recipients, writing: "We've come to destroy you. We're going to carry out a genocide against your people."

The same pseudonym, Mikhail Andropov, had been used in threatening messages sent to European television broadcasters, including Ireland's RTE and Sky, on Friday. Those messages also claimed responsibility for bomb threats that affected dozens of flights in the previous week.

Who is behind the threats?

That is still under investigation. Police Scotland's Cyber and Fraud Unit is carrying out extensive enquiries to establish the source of the messages, and officers are liaising with law enforcement partners across the UK and internationally.

No suspect has been publicly identified. What is known is that the same alias has appeared in a series of menacing messages in recent days, including threats to broadcasters and claims about flight disruption, which suggests a coordinated campaign rather than isolated incidents. Police have not said whether the school emails and the broadcaster threats came from the same sender, and the investigation is continuing.

What should parents do?

Police advice is that children should attend school as normal. Police Scotland said there is no requirement to keep children away from education based solely on the content of the emails, and there is no wider threat to the public.

Parents should follow messages from their own school and council, which will confirm whether the school day is running normally. Schools that closed early or sent pupils home on 11 November 2026 did so as a precaution on the day; no general school closures were advised by police.

Has this happened before?

Yes. This is the second nationwide bomb threat to hit Scotland's schools in recent weeks, following similar hoax messages last month. On that occasion, too, schools were evacuated and police later confirmed the threats were not credible.

The repeated pattern is one reason police and councils acted quickly on 11 November 2026 to confirm the hoax and to advise schools not to evacuate. The Cyber and Fraud Unit investigation is continuing, and police are working with partners in the UK and overseas to trace the source.

Frequently asked questions

Was there a real bomb in any Scottish school? No. Police Scotland said the threatening messages sent on 11 November 2026 were hoaxes and that there was nothing to suggest they represented a credible threat.

Should I keep my child home from school? No. Police advised that there is no requirement to keep children away from education because of the emails. Follow your school's own updates for its arrangements.

Who sent the threatening emails? The emails used the name Mikhail Andropov and claimed to come from a group called the "Red Owl" project. Police Scotland's Cyber and Fraud Unit is investigating the source and has not publicly named a suspect.

Sources: The Sun and Hello Rayo, 11 November 2026.