RTÉ cleared after bomb threat, but who disrupted Dublin’s newsrooms?

By around lunchtime on Friday, November 6, 2026, Gardaí had declared the Dublin campus safe. Newstalk had resumed broadcasting at 10 a.m. local time after staff were advised its warning was a hoax, and the Irish Independent’s evacuation was temporary. The immediate disruption ended; the question of who had caused it did not.⁠2⁠33⁠41

The message reached media organisations in Ireland and Britain, threatening an explosion within 45 minutes. That was the sender’s claim, not confirmation that an explosive device existed. But newsroom managers had to make a safety decision before investigators could establish whether the warning was credible.⁠2⁠38

RTÉ Director General Kevin Bakhurst said the email was sent at about 8:33 a.m. and reached him at 8:40. He consulted colleagues, and staff contacted Gardaí, Ireland’s police. Employees left the buildings for designated safe areas; armed officers attended, and dogs searched the campus.⁠2

Bakhurst described “a lot of disruption,” but said RTÉ had recently reviewed its contingency plans. The broadcaster used prerecorded programming during the interruption and maintained news output through the roadcaster. This was neither a normal morning’s schedule nor a complete loss of live broadcasting: the workplace was unavailable, so part of the operation moved.⁠2

At Marconi House in central Dublin, Newstalk’s evacuation interrupted The Claire Byrne Show. Byrne was presenting the commercial station’s programme when she had to leave the air. On returning, she told listeners that staff had been in contact with Gardaí and had been advised they could return because the warning was a hoax. She apologised for the interruption and continued with her next interview.⁠33⁠43

Newstalk’s restart was at 10 a.m. GMT, Dublin’s local time that day. The 11 a.m. time in SRF’s continental European account was Central European Time—the same moment, not a later resumption. SRF’s account also described RTÉ’s campus as still closed during the search; RTÉ’s later report established the lunchtime clearance. That earlier picture was an interim one, not the day’s final outcome.⁠1⁠2⁠33

The Irish Independent’s staff temporarily left their Talbot Street offices while security checks took place. Mediahuis, the newspaper’s owner, and Bauer Media, which operates Newstalk, therefore both had staff displaced. The Independent’s evacuation is established; a delayed print edition or a lasting interruption to its website is not.⁠41⁠33

Virgin Media Television received the email too, but followed its security procedures, stayed on air and did not evacuate. Receiving the same threat did not produce an identical operational response at every organisation. Nor should the advice given to Newstalk be stretched into a separately documented police search finding for every recipient.⁠2

For the people making those decisions, uncertainty was the problem. A warning could turn out to be false and still require staff to leave, interviews to stop and police to search a workplace. The disruption was real even where the threat was subsequently treated as a hoax.

The government considered a coordinated campaign of disruption likely. Its statement described the fear, distress and disruption caused by hoax threats, and said authorities had taken necessary precautions with the targeted organisations. But it also said responsibility had not been established: an assessment that coordination was likely was not a finding identifying an organiser.⁠37

Taoiseach Micheál Martin said Gardaí, the Defence Forces, and cyber and aviation authorities were working to identify those responsible, in contact with European security counterparts. He discussed broader concerns about Russian connections to hybrid activity, but could not say Russia was responsible for the RTÉ threat. Gardaí said they were liaising with affected Irish media organisations and would investigate threats made here and elsewhere in Europe.⁠4⁠2

The email itself provided an investigative trail, but not an answer. Sent to publicly listed media addresses, it carried the subject line “MESSAGE TO THE WEST” and claimed responsibility for earlier aviation threats. That claim did not establish that the same person or group was behind those incidents.⁠38

The displayed sender address used a domain associated with a Lithuanian school. RTÉ’s examination of the technical headers indicated that the message travelled through Microsoft infrastructure authorised to send for that domain. That made a simply forged sender address less likely. It did not identify whoever wrote or sent the threat.⁠38

Credentials associated with the address appeared in at least two earlier data breaches. The records indicated password reuse and a password exposed in readable form. Cybersecurity researcher Maciej Makowski, who spent almost 13 years in An Garda Síochána, including its National Cyber Crime Bureau, considered unauthorised access to a legitimate account the most likely explanation.⁠38

That remains a hypothesis about how the message could have been sent, not proof of an account takeover. It supplies no basis to accuse the school or the account’s legitimate owner. Investigators would need to distinguish legitimate account activity from any unauthorised use before drawing conclusions about responsibility.⁠38

The political and press-freedom responses reflected the seriousness of threatening newsrooms. Tánaiste Simon Harris said: “Any attack or threat of attack on the media is a threat and attack on our democracy.” National Union of Journalists Irish secretary Seamus Dooley described a deeply disturbing attack on press freedom, while Justice Minister Jim O’Callaghan said efforts would be made to identify those responsible. Those responses did not establish the sender’s identity or political affiliation.⁠4

The supported outcome is narrower—and more useful—than either an ongoing emergency or a solved case. RTÉ’s campus was declared safe, Newstalk returned after receiving hoax advice, and the Independent’s evacuation ended. An email had nevertheless displaced journalists, interrupted broadcasting and brought police into multiple media workplaces. Getting those workplaces back was the immediate task. Establishing who forced them out remained unfinished.⁠2⁠33⁠41