Hundreds of schools in Hungary received bomb threats in the morning hours of January 23, disrupting education. Police later confirmed that no explosives were found. IT security experts said the bomb threats were traced to emails sent through the Russian Yandex platform, suggesting involvement from Russian actors.

A total of 268 schools were targeted with bomb threats, 245 in Budapest and 23 in other parts of the country.

The threatening message, released by the government on social media later, was poorly constructed, with language suggesting the use of translation software. The messages mimicked Islamist-style threats but were inconsistent in tone and style.

"An explosive device was planted in the school. It is time to extend our blessed operations to the heart of Europe, the bastion of unbelief and hypocrisy. We have witnessed your government’s ongoing war against Muslims, and it would only be fair that you experience the voice of the oppressed. From now on, your safety is no longer guaranteed."

The letter continued: "Let your leaders know that the lions of the Caliphate will strike at any moment," the anonymous writer warned, adding threats of building explosions and bloodshed in Budapest.

Shortly after the news broke, different interpretations emerged, unsurprising in a country as deeply polarised as Hungary. Conspiracy theories circulated online, with some accusing the government of benefiting from or even staging the threats.

Some online users speculated that the government might have staged the threats to bolster its ongoing security narrative. Critics claimed the incident plays into the government’s rhetoric on terrorism and migration as key security risks.

Pro-government bloggers made unsubstantiated claims linking opposition leader Peter Magyar, head of the Tisza Party, to the threats.

Government spokeswoman Eszter Vitályos posted on Facebook, framing the threats as evidence of Brussels' "flawed migration policies" endangering Europe. She also accused Brussels of promising immunity to Peter Magyar, alleging he supported their agenda in exchange.

The reference to the opposition leader in the case suggests that the government is using dirty tactics to implicate Magyar, whose party seemed to have stabilized its lead over Fidesz, based on the latest polls.

Several pointed to a possible Russian connection, highlighting similarities with suspected Russian operations in neighbouring countries. Similar bomb threats referencing Islamist terrorism were recently sent to Bulgarian and Czech schools, but intelligence sources in both countries suspect Russian involvement, hinting at hybrid warfare tactics.

Last fall, the head of the Czech secret service, Michal Koudelka, explicitly blamed Russia for similar bomb threats against schools in the Czech Republic and Slovakia.

IT analysis revealed that the account was linked as a secondary email to a Yandex account with Russian language settings, investigative news site Atlatszo reported on Thursday night.

The bomb threats originated from a disposable email address (harcos@coredp.com) tied to an account using Russian language settings on a Yandex email service with an Armenian domain (.am).

The coredp.com email address allows users to remain anonymous. The account's user reportedly used a German VPN for added anonymity, Atlatszo writes, citing an expert on Reddit, who shared screenshots confirming the details about the account's setup and activity.

Opposition leader Peter Magyar raised the question of the responsibility of Hungarian intelligence services, which are overseen by Antal Rogan, who is on the US sanctions list under the Global Magnitsky Act. Opposition parties called for a meeting of Parliament's National Security Committee.