Skip to content
Campus Alert Archive
RIT

Threatening email declared not credible after building checks; no campus-wide evacuation

AI-generated · every claim is source-linked
NYswattingemergency notificationhigh confidence
Confirmed HoaxDetermined to be a hoax. The institutional response is documented because it reveals how the alert system performed under a perceived real threat.

On Tuesday, September 30, 2025, RIT received a threatening email as part of a nationwide swatting trend circulating on TikTok. Public Safety checked multiple buildings and determined the threat was not credible without ordering a full campus evacuation, then issued a campus-wide "All Clear" statement that same morning. The case is notable for RIT's decision not to escalate to a campuswide shelter-in-place after rapid pattern-matching against threats received by other campuses that morning.

Alerts
1
Response
Killed
0
Injured
0
Institution
Rochester Institute of Technology
Private R2 · NY
All RIT cases →
~19,000 studentsRIT Alert
Documented Timeline

Alert Sequence

1 message in sequence · 1 verified verbatim

ALL CLEAREmail
Earlier today, RIT Public Safety, in conjunction with the Monroe County Sheriff's Office, responded to a report of an emergency on campus. After a thorough investigation, authorities swiftly confirmed that a threatening email sent to multiple people was false and part of a disturbing trend known as "swatting," which involves sending fake emergency emails or calls to provoke a police response. Multiple buildings were checked and we believe there was no actual threat to our campus. We understand that incidents like this can be unsettling, and we want to assure you that your safety remains our highest priority. RIT Public Safety worked closely with local law enforcement to respond swiftly and appropriately. We are aware that this type of hoax has been circulating on social media platforms, including TikTok, and we are actively monitoring the situation.
The official RIT statement confirms that multiple buildings were checked, no full campus evacuation was ordered, but the threat was not simply dismissed without a sweep
The explicit mention of TikTok is notable, most swatting hoaxes originate from anonymous email or VoIP calls, but the Sept 30 wave was unusual in being amplified on a major social platform
RIT framed the message as a single 'All Clear' communication rather than escalating with an initial shelter-in-place alert, reflecting confidence the email threat was a hoax
Message elements

How the first alert is built

To check this alert, Claude (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

Earlier today, RIT Public Safety, in conjunction with the Monroe County Sheriff's Office, responded to a report of an emergency on campus. After a thorough investigation, authorities swiftly confirmed that a threatening email sent to multiple people was false and part of a disturbing trend known as "swatting," which involves sending fake emergency emails or calls to provoke a police response. Multiple buildings were checked and we believe there was no actual threat to our campus. We understand that incidents like this can be unsettling, and we want to assure you that your safety remains our highest priority. RIT Public Safety worked closely with local law enforcement to respond swiftly and appropriately. We are aware that this type of hoax has been circulating on social media platforms, including TikTok, and we are actively monitoring the situation.

  • Sourcepresent25/25

    Final assessment

    Unanimous: RIT Public Safety and the Monroe County Sheriffs Office are named as responders.

    Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

    See all 25 individual reads
    1. present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", the responding authorities.
    2. present: It identifies "RIT Public Safety" and "Monroe County Sheriff's Office" as responders.
    3. present: It names "RIT Public Safety" and the "Monroe County Sheriff's Office" as authorities.
    4. present: It names "RIT Public Safety" and "Monroe County Sheriff's Office" as responders.
    5. present: It identifies "RIT Public Safety" and the "Monroe County Sheriff's Office" as the responding authorities.
    6. present: It names "RIT Public Safety" and "the Monroe County Sheriff's Office", responding authorities.
    7. present: Identifies "RIT Public Safety" and the "Monroe County Sheriff's Office" as responders.
    8. present: It names "RIT Public Safety" and the "Monroe County Sheriff's Office" as responding authorities.
    9. present: Names "RIT Public Safety" and "Monroe County Sheriff's Office", clear responding authorities.
    10. present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", the responding authorities.
    11. present: Identifies the senders "RIT Public Safety" and the "Monroe County Sheriff's Office".
    12. present: Names "RIT Public Safety" and the "Monroe County Sheriff's Office" as the responding authorities.
    13. present: It names "RIT Public Safety" and "the Monroe County Sheriff's Office", the responding authorities.
    14. present: Identifies the sender as "RIT Public Safety" working with "Monroe County Sheriff's Office".
    15. present: Identifies "RIT Public Safety" and "Monroe County Sheriff's Office" as responding authorities.
    16. present: Names "RIT Public Safety" and "Monroe County Sheriff's Office", responding authorities.
    17. present: Identifies "RIT Public Safety" and "Monroe County Sheriff's Office" as responding authorities.
    18. present: It names "RIT Public Safety" and the "Monroe County Sheriff's Office" as the responding authorities.
    19. present: It names "RIT Public Safety" and the "Monroe County Sheriff's Office", responding authorities.
    20. present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", the responding authorities.
    21. present: Identifies "RIT Public Safety" and "Monroe County Sheriff's Office" as responders.
    22. present: The text names "RIT Public Safety" and "Monroe County Sheriff's Office", identifying the responding authorities.
    23. present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", responding authorities.
    24. present: Identifies "RIT Public Safety" and the "Monroe County Sheriff's Office" as responding authorities.
    25. present: It names "RIT Public Safety" and "Monroe County Sheriff's Office", identifying responding authorities.
  • Hazardpresent25/25

    Final assessment

    All reads agree: the alert names specific threats, a swatting hoax and a threatening email.

    What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

    See all 25 individual reads
    1. present: It names "swatting" and a "threatening email", specific threats described.
    2. present: It names a specific threat type, a "threatening email" and "swatting" hoax.
    3. present: It identifies the threat as a "threatening email" and "swatting" hoax.
    4. present: It identifies the threat as a false "swatting" hoax via a "threatening email", a specific hazard.
    5. present: It names the hazard as a "threatening email" and "swatting", a specific hoax-threat type.
    6. present: It names a "swatting" hoax via a "threatening email", a specific described threat.
    7. present: Names the threat as a "swatting" hoax via a "threatening email", a specific hazard type.
    8. present: It names the threat as a "threatening email" and "swatting", a specific hoax hazard.
    9. present: Names the hazard as a "threatening email" and "swatting", a specific hoax threat.
    10. present: It names the threat as a "swatting" hoax involving a "threatening email", a specific described hazard.
    11. present: Names the threat as a false "threatening email" and "swatting", a specific hazard.
    12. present: It names "swatting", a threatening email hoax, as the specific hazard.
    13. present: It names the threat specifically as a "threatening email" and "swatting" hoax.
    14. present: Names the threat specifically as a "swatting" hoax via a false "threatening email".
    15. present: Names the threat as a false "threatening email" and "swatting", a specific hazard type.
    16. present: Names the threat as a "threatening email" and "swatting", a specific hoax hazard.
    17. present: Names the threat as a "threatening email" and "swatting", a specific hazard.
    18. present: It identifies the threat as a "swatting" hoax via a "threatening email", a specific hazard.
    19. present: It describes "swatting", a threatening hoax email, a specific named threat.
    20. present: It identifies the threat as a "threatening email" and "swatting" hoax, a specific hazard type.
    21. present: Names the threat as a false "threatening email" and "swatting", a specific hazard.
    22. present: It names "swatting", a "threatening email", and a "hoax", specifying the threat type.
    23. present: It names the threat as a "swatting" hoax via "threatening email", a specific hazard described.
    24. present: Names the threat as a "threatening email" and "swatting", a specific hazard.
    25. present: It describes a "swatting" hoax via "a threatening email", naming the specific threat type.
  • Locationpresent25/25

    Final assessment

    Unanimous: a location is given, on campus with multiple buildings checked.

    Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

    See all 25 individual reads
    1. present: It says the response was "on campus" and "Multiple buildings were checked", a location.
    2. present: It says the response was "on campus" and "Multiple buildings were checked".
    3. present: It says the response occurred "on campus" and "multiple buildings were checked".
    4. present: It says the report was of an emergency "on campus" and "multiple buildings were checked".
    5. present: It says the response was "on campus" and that "Multiple buildings were checked".
    6. present: It says the response was "on campus" and "Multiple buildings were checked", indicating location.
    7. present: Refers to "on campus" and "Multiple buildings", indicating location.
    8. present: It says responders acted "on campus" and checked "multiple buildings", a location reference.
    9. present: Says it occurred "on campus" and that "Multiple buildings were checked".
    10. present: It says the response was "on campus" and "Multiple buildings were checked", a location.
    11. present: Says it occurred "on campus" and that "multiple buildings were checked".
    12. present: It refers to "on campus" and "Multiple buildings", indicating location.
    13. present: It says the response was "on campus" and "Multiple buildings were checked", a location.
    14. present: Refers to "campus" and "Multiple buildings were checked", indicating place.
    15. present: Says the response was "on campus" and "Multiple buildings were checked", indicating location.
    16. present: Says the report was of "an emergency on campus" and "Multiple buildings were checked", a location.
    17. present: Says the response was "on campus" and "Multiple buildings were checked".
    18. present: It says the report was of an emergency "on campus" and "Multiple buildings were checked".
    19. present: It says the report was "on campus" and "Multiple buildings were checked", locations.
    20. present: It says the response was "on campus" and that "Multiple buildings were checked".
    21. present: Says it occurred "on campus" and refers to "Multiple buildings", specific places.
    22. present: It says the response was "on campus" and "Multiple buildings were checked", giving location.
    23. present: It says the response was "on campus" and "Multiple buildings were checked", a location.
    24. present: Says the response was "on campus" and "Multiple buildings were checked", a location.
    25. present: It refers to "on campus" and "Multiple buildings", indicating location.
  • Guidanceabsent0/25

    Final assessment

    Unanimous: the message describes responder actions but directs no protective action to recipients.

    The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

    See all 25 individual reads
    1. absent: It describes what responders did but gives recipients no protective action to take.
    2. absent: It describes what responders did but gives recipients no protective action.
    3. absent: It describes responder actions and reassurance, giving recipients no protective instruction.
    4. absent: It describes responder actions and reassurance but gives recipients no protective instruction.
    5. absent: It describes what responders did but gives recipients no protective action to take.
    6. absent: It describes what responders did but gives recipients no protective action to take.
    7. absent: Describes responders' actions and reassurance but gives recipients no protective instruction.
    8. absent: It only describes what responders did and assures safety, giving recipients no protective action to take.
    9. absent: It reassures and describes responder actions but gives recipients no protective action.
    10. absent: It describes responders' actions and reassurance but gives recipients no protective instruction.
    11. absent: It reassures and describes responder actions but gives recipients no protective instruction.
    12. absent: It describes what responders did but gives recipients no protective action to take.
    13. absent: It describes what responders did but gives recipients no protective action to take.
    14. absent: It reassures and describes responder actions but gives recipients no protective instruction to take.
    15. absent: Reassures the community but gives recipients no protective action to take.
    16. absent: The message reassures and describes responder actions but gives recipients no protective instruction.
    17. absent: No protective action is directed at recipients; it only reassures and describes responder actions.
    18. absent: It describes what responders did but gives recipients no protective action to take.
    19. absent: It describes responder actions and reassurance, no protective instruction to the recipient.
    20. absent: It describes responder actions and reassurance but gives recipients no protective action to take.
    21. absent: No protective action is instructed to recipients; it describes what authorities did.
    22. absent: It describes what responders did but gives recipients no protective action instruction.
    23. absent: It describes responder actions and reassurance but gives recipients no protective instruction.
    24. absent: Describes responder actions and reassurance; gives recipients no protective instruction.
    25. absent: It only reassures and describes responder actions; it gives recipients no protective instruction.
  • Timepresent25/25

    Final assessment

    All reads agree phrases like Earlier today and actively monitoring supply recency cues.

    When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

    See all 25 individual reads
    1. present: It says "Earlier today" and "actively monitoring", recency cues.
    2. present: "Earlier today" conveys recency.
    3. present: It says "Earlier today", a recency reference to when events occurred.
    4. present: It says "Earlier today", a recency cue.
    5. present: It uses time cues "Earlier today" and "actively monitoring the situation".
    6. present: It says "Earlier today", a recency reference to when the event occurred.
    7. present: Says "Earlier today", a recency reference.
    8. present: It says the response happened "Earlier today", a recency cue.
    9. present: Says "Earlier today", a recency reference to when it happened.
    10. present: It says "Earlier today", a recency reference.
    11. present: Says "Earlier today", conveying recency.
    12. present: It says "Earlier today", a recency cue.
    13. present: It says "Earlier today" and "actively monitoring", recency cues.
    14. present: Uses "Earlier today", a recency reference, and notes it is "actively monitoring".
    15. present: Says "Earlier today", conveying recency relative to the message.
    16. present: Uses "Earlier today", conveying recency.
    17. present: Says "Earlier today", a recency cue.
    18. present: It says "Earlier today", a recency reference.
    19. present: It says "Earlier today", a recency reference.
    20. present: It says "Earlier today", a recency reference to when the event occurred.
    21. present: Says "Earlier today", a recency reference.
    22. present: It says "Earlier today" and "actively monitoring", conveying recency.
    23. present: It says "Earlier today", a recency cue.
    24. present: Uses "Earlier today" and "actively monitoring", recency cues.
    25. present: It says "Earlier today", a recency cue.
  • Impactabsent7/25

    Final assessment

    Absent (18 of 7). The message reassures there was no actual threat and the report was a false swatting hoax, conveying no real harm; a minority counted the unsettling nature or police response as impact.

    What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

    See all 25 individual reads
    1. absent: Confirms a swatting hoax with no actual threat and reassures safety, stating no real harm occurred.
    2. absent: It explains a false swatting email caused a response and confirms no actual threat, conveying no harm or danger.
    3. absent: It explains a swatting hoax was confirmed false with no actual threat to campus, stating no harm occurred.
    4. absent: It explains a swatting hoax was confirmed false with no actual threat, so it states reassurance rather than any harm or danger.
    5. present: States the swatting hoax was false with no actual threat but acknowledges incidents can be unsettling, and the no-threat finding addresses potential harm.
    6. absent: Describes a swatting hoax and confirms no actual threat, stating no harm occurred.
    7. present: Describes a swatting hoax and explicitly states there was no actual threat, but acknowledges incidents like this can be unsettling and is reassuring safety, with the harm framed as the false alarm itself; however no stated danger to people, so absent.
    8. present: It states authorities confirmed no actual threat to campus, meaning the message conveys the consequence that there was no danger; however it describes a swatting hoax only, so no harm to people or property is conveyed.
    9. absent: Explains a swatting hoax was confirmed false with no actual threat, stating no harm occurred to the campus.
    10. present: It describes a swatting hoax that was confirmed false with no actual threat, but it explains swatting provokes a police response and was unsettling, conveying the nature and impact of the hoax.
    11. absent: Explains a swatting hoax was confirmed false with no actual threat, stating no real harm occurred.
    12. present: It confirms a swatting hoax with no actual threat but explicitly states such incidents can be unsettling, acknowledging a harm to the community.
    13. present: Describes a false swatting threat and explicitly notes such incidents can be unsettling but confirms no actual threat; the acknowledgement of harm to wellbeing and the threatening email context conveys impact, though borderline.
    14. absent: It explains a swatting hoax was confirmed false with no actual threat, stating no harm occurred or was possible.
    15. absent: The text confirms a swatting hoax with no actual threat and reassures the community, stating no harm occurred.
    16. absent: Explains the swatting hoax was false with no actual threat, so it conveys no harm or danger to people or property.
    17. absent: It states a swatting email was false and there was no actual threat, conveying reassurance rather than harm.
    18. absent: Describes a swatting hoax that was confirmed false with no actual threat, so no harm or danger is conveyed.
    19. absent: Describes a false swatting email confirmed to pose no actual threat, stating there was no harm to campus.
    20. absent: Explains a swatting hoax was false and there was no actual threat, stating no harm to people or property.
    21. present: Describes the swatting hoax as a disturbing trend meant to provoke police response and acknowledges it can be unsettling, but confirms no actual threat; the explicit harm is minimal, however it states the danger was false so no real impact, coding absent.
    22. absent: Explains a swatting hoax was confirmed false with no actual threat, stating reassurance rather than any harm.
    23. absent: It describes a swatting hoax that was confirmed false with no actual threat, so no harm or danger is conveyed.
    24. absent: Confirms a swatting hoax with no actual threat and reassures the community, stating no harm occurred.
    25. absent: It explains a false swatting email and confirms no actual threat, stating no harm occurred.

Systematic AI judgments with visible reasoning, not human-validated codings.

About this analysis
Context

Background

On Tuesday, September 30, 2025, RIT received a threatening email sent to multiple recipients on campus. Public Safety quickly determined the threat was not credible and issued a campus-wide statement confirming the hoax after checking multiple buildings, without ordering a full campus evacuation. The hoax was identified by RIT and the Monroe County Sheriff's Office as part of a TikTok-driven swatting trend targeting universities nationwide. RIT's response stood out for not escalating to a campuswide shelter-in-place, a calculated decision enabled by rapid pattern-matching against threats received by peer institutions the same morning. Across the Rochester metropolitan area, Nazareth University followed the more conventional protocol, evacuating its library and Clocktower Commons before declaring an all-clear. Nationally, at least 13 universities received threats on September 30, 2025, including Alabama A&M, Towson, Morgan State, Delaware State, the University of Delaware, Prairie View A&M, Lone Star College-University Park, Monroe Community College, Western Washington, the University of Alaska Fairbanks, and Utah State.
Analysis

Key Findings

RIT's decision to check buildings but not order a full campus evacuation reflects an emerging tactic of 'pattern-matched de-escalation' where universities can scale down a response by recognizing a threat as part of an ongoing copycat wave
Explicit attribution of the hoax to a TikTok trend is rare in official university statements; most institutions decline to name a specific platform
RIT and Nazareth, six miles apart, took diametrically opposed approaches to nearly identical threats: RIT issued a stand-down advisory while Nazareth evacuated buildings, illustrating how administrative judgment shapes campus disruption
Outcome
RIT Public Safety reviewed the threat email, coordinated with the Monroe County Sheriff's Office, and concluded the threat was a hoax, part of a broader TikTok-driven swatting trend. Multiple buildings were checked but no full campus evacuation was ordered. The university issued a single 'All Clear' communication confirming there was no credible threat. The same morning, neighboring Nazareth University evacuated its library and Clocktower Commons after receiving a similar threat.
Provenance

Sources

  1. Official
  2. News
  3. News
  4. News
  5. News
Cite this case

Campus Alert Archive. "Rochester Institute of Technology: Threatening email declared not credible after building checks; no campus-wide evacuation." Incident of September 30, 2025. Added May 2026. https://campusalertarchive.com/case/rochester-institute-of-technology-swatting-2025-09-30/

Download case JSON

Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.

Tags
swattingbomb-threathoaxnew-yorkrochestertiktok-trendemail-threatno-evacuationprivate-r2Hoax
Added May 2026Updated May 2026Via ingestion