FBI warns of coordinated swatting attacks targeting US institutions
The FBI reports ongoing coordinated swatting campaigns using VoIP to make hoax emergency calls against schools, government buildings, hospitals, and other public facilities to cause disruption and panic.
Sourceic3.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Swatting is a malicious tactic where threat actors make false emergency reports to law enforcement to trigger large-scale police responses at victim locations. The FBI has observed a shift from targeting private individuals to coordinated attacks against educational institutions, government buildings, religious sites, transportation centers, and hospitals across the United States. These campaigns aim to disrupt operations, cause fear and chaos, and waste emergency service resources that could otherwise respond to genuine emergencies.
The FBI identifies several technical and behavioral indicators of swatting activity: use of VoIP numbers (often appearing as blocked, unavailable, or sequences of zeros/nines) to target multiple victims, single-caller reports rather than multiple witness calls typical of real emergencies, calls originating internationally, vague or inconsistent incident details, mispronunciation of local place names suggesting unfamiliarity with targeted areas, and callers who maintain composure inconsistent with the described emergency or appear to read from a script.
Defenders should implement awareness training, review online information exposure, maintain operational security in social media sharing, and establish response procedures for law enforcement contact. Victims should preserve all incident evidence including call details, usernames, and platform information, and report to local law enforcement and the FBI.
Source reporting: https://www.ic3.gov/PSA/2026/PSA260804
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs