Email Bomb Threats Were a Hoax—and a 'Terrible Strategy'

Extortion warnings sent around the US, Canada demanded $20K in bitcoin
By Jenn Gidman,  Newser Staff
Posted Dec 14, 2018 11:21 AM CST
'We Are Not Terrorists': the Email Bomb-Threat Hoax
Deputies from the Washtenaw County Sheriff's Office investigate a reported bomb threat on Thursday in Scio Township, Mich.   (Ben Allan Smith/Ann Arbor News via AP)

Chaos ensued across the US, Canada, and New Zealand Thursday after schools, businesses, government buildings, media outlets, and other venues were hit with a wave of email threats that warned of bombs going off at each target if $20,000 in bitcoin wasn't paid up, USA Today reports. Police departments scrambled to find out who was behind the emails, and it was ultimately deemed a hoax, but experts say "hoax" doesn't mean "not damaging." That's because even if financial extortion wasn't the actual goal, the suspects still caused disruption. Even more worrisome, some fear it could have been a test run to gauge law enforcement's reaction—and that such disruption could be used in the future to force police to expend resources, making them vulnerable while a "secondary more potent attack" is carried out. More on what we know:

  • Read the emails: The police department in Cedar Rapids, Iowa, and cybercrime expert Brian Krebs have both posted full examples of the emails that are circulating. In both messages, the sender tells the recipient to not take it personally and that "this is just a business." They also stress: "We are not terrorists."
  • Explosives and wallets: In fact, several versions are making the online rounds. The threats mainly vary in the type of explosives they mention, and there are different "wallets" to which recipients are supposed to send their cryptocurrency. The Verge notes the various wallets are a "common tactic" used in such ransomware situations, as the perps can keep tabs on who has paid and who hasn't.

  • Similar to 'sextortion' plot: Cybersecurity analyst David Pickett tells USA Today there's a "99% chance" that the same group that sent these emails also sent "sextortion" messages to people in the UK earlier this year. Some of the emails this time around were even sent from the same servers as the sex-themed ones. That, too, was a large-scale hoax.
  • Not so effective: Security researcher Troy Mursch concurs these emails are strikingly similar to the sextortion emails, but he tells Wired that in this case it's a "terrible strategy." That's because the violent undertones of this new threat will turn up the heat from law enforcement way higher than the suspects probably want. Plus, the large ransom being demanded would be harder for gullible victims to generate; the sextortion ransoms were smaller and may have been worth it for recipients to come up with just to make the whole thing disappear.
  • Who got hit: The AP has more specifics on the supposed targets. Dozens of schools across the country closed early or were put on lockdown, including one Missouri school that received an email threat sent from Russia. In what apparently wasn't part of the nationwide hoax, a separate bomb threat was called into Columbine High School. That threat was found to be baseless, per CNN.
  • Bitcoin suffers: The brouhaha affected bitcoin, too: Business Insider reports the cryptocurrency was down more than 6% (about $3,300 per coin) after the threats circulated, its lowest level in more than a year.
(More hoax stories.)

Get the news faster.
Tap to install our app.
Install the Newser News app
in two easy steps:
1. Tap in your navigation bar.
2. Tap to Add to Home Screen.