A wave of bomb threats was reported Thursday against businesses, schools, hospitals and other places across the United States and Canada, causing panic and evacuations, although all appeared to be hoaxes.
Police in both countries reported threats, some emailed, some phoned in. The FBI said in a statement that it was aware of the threats and encouraged the public to promptly report any suspicious activities.
Authorities in New York City were monitoring "multiple bomb threats that have been sent electronically to various locations throughout the city," the New York Police Department's counterterrorism bureau said on Twitter.
"These threats are also being reported to other locations nationwide & are NOT considered credible at this time," the police department said.
New York police said later on Twitter that there was an "email being circulated containing a bomb threat asking for bitcoin payment" but that no devices had been found. They said it appeared that the threats were "meant to cause disruption and/or obtain money."
Students were evacuated from the Bronx High School of Science at 11 a.m. Thursday after a bomb threat was phoned in, NBC New York reported. Police in Nassau County, New York, meanwhile, said they responded to 12 emailed bomb threats.
An Oklahoma City police spokesman said 10 to 13 email bomb threats were sent to specific addresses in and around the city but that investigators hadn't found anything serious.
Massachusetts State Police said on Twitter that their bomb squad was responding to "multiple bomb threats emailed to numerous businesses in the state." They said in a tweet later that there were no indications "of any explosives located or detonated to this point."
A false bomb threat was also made against Columbine High School near Littleton, Colorado, where two students killed 13 people in April 1999 in what was the deadliest school shooting in U.S. history at the time.
A caller claimed to have "multiple explosive devices" inside the school on Thursday morning, said Mike Taplin, a spokesman for the Jefferson County Sheriff's Office. Columbine and 28 other nearby school were placed on "lockout," according to Jefferson County Public Schools.
In San Francisco, police said they also responded to reports of bomb threats at numerous locations. Employees at a Jewish community center and multiple branches of the San Francisco Fire Credit Union were evacuated, NBC Bay Area reported. At least two dozen threats were being tracked in Los Angeles, law enforcement sources told NBC Los Angeles.
South Elgin, Illinois, police said an emailed bomb threat at one business directed the company to send "$20,000.00 to a bitcoin account by the end of the business day in order to stop the alleged threat." Police said that they then became aware of other threats in the area and that the incident is believed to be a phishing scam.
Cincinnati police said in a statement that they were monitoring multiple bomb threats sent electronically to locations throughout the city.
Police in Washington, D.C.; Norfolk, Virginia; and Frederick, Maryland, said they were also multiple reports of bomb threats. Washington Mayor Muriel Bowser said authorities "have no knowledge" that anyone paid bitcoin to the sender, NBC Washington reported.
Among the many businesses that were evacuated was WNDU-TV, the NBC affiliate in South Bend, Indiana.
"It makes you feel uneasy," said John O'Brien, the station's general manager. "It's upsetting. It's a disruption. We've all seen how much things like this go on today in our society — we see it a lot — but you have to take each and every one of these instances seriously, because you never know when it's a real threat."
Maureen McFadden, an anchor for the station, said, "A whole lot of people have had a stressful afternoon just like we have."
Dan Leahy, a senior systems administrator in Colorado who manages websites for several companies, told NBC News that the firms whose tech infrastructure he manages received a "flood" of bomb threats from 12:56 p.m. ET until 1:07 p.m. He estimated that the companies received 40 of the threats, which were almost identical.
"We talked to our VP of safety. Even though we knew this was crap, we have to do that just in case there's one legitimate bomb going off in one office," Leahy said.
Leahy said he believed some of the emails slipped through because they came from email addresses with what he called "clean" records or from email accounts that likely had been phished and hacked. He said the emails came from verified domains of non-malicious websites, like law firms and construction companies.
The "clean" domain records, partnered with emails that didn't include attachments, allowed the emails to bypass spam filters.
"I've been in IT for years, and I've seen a ton of these scams, but I've never seen a bomb threat," Leahy said.