Italian authorities identified a 14-year-old boy and his mother in connection with a series of fake bomb threats that forced the evacuation of six shopping centers across the Milan metropolitan area on Wednesday, August 5, 2026. No explosives were found during the sweeps, and the sites were cleared to reopen by August 6.
The panic began on Wednesday afternoon when the general managements of six major retail hubs received identical, emails with the subject “read urgently”. The messages contained disjointed phrasing and claims that explosive devices had been planted with the intent to cause maximum casualties.
Between 4:00 p.m. and 5:30 p.m., hundreds of shoppers—including many tourists and elderly residents seeking refuge from a heatwave—were ushered out of the buildings. Police cordoned off the surrounding areas, and in Rozzano, authorities went as far as closing a highway interchange to facilitate the emergency response.
Six Evacuated Sites and the “Presidential” Demand
The scale of the disruption spanned both the city of Milan and its outskirts.
- Fiordaliso in Rozzano
- Bonola in Milan
- Carosello in Carugate
- Acquario in Vignate
Beyond the threat of violence, the emails contained a specific and unusual demand: the author requested to speak with the President of the Republic, Sergio Mattarella. According to reporting from MilanoToday, the sender claimed to have been instructed by an “anonymous” source on how to build bombs, stating they hoped that there would be many victims and wished to become an example for others like them.
The 14-Year-Old Suspect and the “Online Vendetta”
The investigation, coordinated by the Lodi Prosecutor’s Office, quickly traced the communications to a phone number registered to a woman of Ukrainian origin. However, carabinieri determined that the device was actually used by her 14-year-old son. Both individuals were located in the Marche region.
When questioned, the teenager denied sending the emails. Instead, he suggested the threats were a spiteful act or “ripicca” (vendetta) carried out by friends he had met while gaming online. He had previously told these online acquaintances that he lived in the Milan area, which may explain why the local shopping centers were targeted.
While the boy is not currently under formal investigation, his mother may be entered into the register of suspects as officials verify the ownership and usage of the phone line.
Technical Hurdles and the Russian Domain
Despite the rapid identification of the phone user, digital forensics faced a significant roadblock. Investigators found that the emails were sent via a Russian web domain, which has limited the ability of technicians to conduct deeper analysis of the account’s origins.
This disconnect between the physical location of the suspect in Marche and the digital origin of the emails suggests the use of an account created specifically for this incident. The legal fallout is expected to expand, as the Lodi Prosecutor’s Office may be joined by prosecutors in Milan and Ancona to handle the multi-jurisdictional nature of the crime.
Emergency Response and Public Safety
The operational response involved a massive deployment of resources. Bomb disposal experts, K9 units, the mobile radio nucleus, and firefighters swept every site. In San Giuliano Milanese, Mayor Marco Segala used social media to urge residents to stay away from the affected zones and rely only on official channels to avoid the spread of unverified news.
For security reasons and as a precautionary measure, we decided to temporarily close Scalo Milano Outlet & More… The safety of our guests, commercial partners and employees is, as always, our top priority. Management of Scalo Milano, via Corriere
The immediate physical danger was nonexistent, as no explosives or armed individuals were found. However, the psychological impact was significant; hundreds of people were left stranded in the heat, with some employees at Scalo Milano forced to wait under trees for hours before the sites were officially cleared.
Recovery and Legal Next Steps
By the evening of August 5, the threat was officially classified as a false alarm. While some centers remained closed overnight for final canine sweeps, all facilities were expected to resume regular operations on August 6.
The case now shifts from emergency management to criminal proceedings. The primary charge is procurato allarme
(causing a false alarm). Investigators must now determine if the 14-year-old was indeed the perpetrator or if his account was hijacked by the online “friends” he mentioned, a distinction that will dictate whether the boy faces juvenile justice proceedings or remains a witness in the case.
Worth a look
