A tsunami of email bomb threats is causing shutdowns at hospitals, schools, public transit centers, and businesses across the US and Canada.
The text of the emails emerged Wednesday morning in tweets like this one:
So I just got a bomb threat in my work email today ordering me to send people $20,000 via bitcoin or they will blow up my workplace…. 2018 was wild. pic.twitter.com/sn0vVLwe6v
— Ryan William Grant (@TheeRyanGrant) December 13, 2018
And this:
A truly sinister twist on the classic spam: bomb threats. A surprisingly good way to attract the attention of the FBI, though ¯\_(ツ)_/n
(Check out that closing quote!) pic.twitter.com/ShX1bP6Tee
— sammy (@0x736A) December 13, 2018
The emails warned that explosives had been planted in the recipient’s area and would explode by the end of the day unless the target paid $20,000 in bitcoin. On Wednesday afternoon, Sammy, the email security researcher who sent one of the tweets above, told Ars that he and other researchers estimated more than 100,000 such emails had been received. A large percentage of the emails, he said, use unique wallet addresses and variations on the sender’s name and the type of explosive material.
The emails caused shutdowns across the country, including:
- Disruptions to the San Francisco City Railway bus lines and cancellations of the San Francisco Jewish Community Center and the San Francisco Fire Credit Company, such as San Francisco Chronicle.
- Multiple hospital and business closures in Chicago, as reported by ABC 7 of the city.
- Home closings and school closings in Tampa, Florida, the Tampa Bay Times reported.
So far, no reports of any explosive devices have been found. Police across the country said the threats were unfounded:
At this time, it appears that these threats are meant to cause disruption and/or extort money. We will respond to each call regarding these e-mails to conduct a search but we want to share this information so that we can assess the credibility of these threats as possible NOT BELIEVED.
— NYPD NEWS (@NYPDnews) December 13, 2018
It seems unlikely that the person or persons responsible for the wave of emails are hoping to make money from the stunt. After all, the average person will need a day or more to figure out how to use bitcoin. And even people who take bitcoin are unlikely to pay $20,000 without calling the police first.
More motivation is to create disruptions at an unprecedented scale or at least to experiment with such multiple disruptions. Unfortunately, the hoaxers seem to have succeeded.