Bomb Threats Divert Flights Across Europe as Fighter Jets Scramble in Second Wave in a Week

Bomb threats forced at least a dozen passenger flights across Europe to divert, land under escort or undergo emergency searches on Thursday morning, the second wave of aviation alerts to hit the continent in a week, according to Reuters. Fighter jets were scrambled, a French military airbase received a diverted airliner carrying 151 passengers, and airports from Prague to Sofia went on alert — yet, as with the threats two days earlier, no explosive device was found on any aircraft.

The most dramatic incident of the morning involved Aer Lingus flight EI402, an Airbus A320 flying from Dublin to Rome with 151 passengers and six crew members on board. According to Reuters, the aircraft changed course over France after a bomb threat and landed safely at Évreux-Fauville Air Base in Normandy, a French military installation about 100 kilometres west of Paris. The Irish airline said in a statement that the flight had diverted “as a security precaution” and that it would work to re-accommodate customers to their final destination as soon as possible.

Flight-tracking data showed the aircraft departing Dublin at 6.19am GMT and cruising at 37,000 feet west of Paris before its crew issued the squawk code 7700 — the international signal for a general emergency — and began a series of turns over northern France before heading for Évreux. Le Figaro reported that a French Rafale fighter jet escorted the airliner during its approach to the military base. The office of French Prime Minister Sébastien Lecornu said it was following the situation in real time, and later confirmed that the 151 passengers and six crew had been moved to a safe place while bomb disposal specialists inspected the cabin and cargo.

It was far from the only aircraft affected. Bulgarian officials reported three aircraft making emergency landings in the Balkan country because of bomb threats, according to Reuters. Flights from Copenhagen and Madrid landed safely in Sofia, the interior minister said, according to broadcaster bTV, while a third aircraft, a Ryanair flight from London Stansted, was diverted and landed in Plovdiv, Bulgaria’s second-largest city.

Czech police said on X that four airplanes heading to Prague had received bomb threats on Thursday and that authorities were making preparations for the landings, although they assessed the credibility of the threats as low. Italy’s air force safely escorted a Finnair plane from Helsinki to its scheduled landing in Rome, a person close to the matter told Reuters, while another Finnair flight from Helsinki, operated by Jettime, landed as normal in Vienna after receiving a bomb threat, the Finnish carrier said.

Polish airline LOT said a flight from Warsaw to Brussels had landed safely at its destination after a security warning and that no suspicious items were found. It also said a LOT flight to Paris had been stopped as it was taxiing towards take-off and that its passengers had then been transferred to another aircraft as a precaution. Italian media reported that a Wizz Air flight from Milan to Warsaw had to land in Vienna due to a bomb threat.

Counts of the affected flights varied as reports came in during the morning. The Times reported that at least a dozen flights were affected, while The Guardian reported at least eight, and The Sun put the figure at 15. The Times also reported that at least 20 flights in four days have now faced bomb threats across Europe.

A week of threats

Thursday’s wave came only two days after at least seven passenger flights across Europe were targeted by bomb threats in a single day, according to Reuters. None of the searches carried out after those alerts found explosives, and every aircraft landed safely with no one injured.

On Tuesday 3 November, the threats affected flights heading to Warsaw, Sofia, Rome and Murcia in Spain, and a cruise ship was also targeted. In Poland, a LOT flight from London Heathrow, a Boeing 737 MAX carrying 181 people, was diverted from Warsaw’s Chopin Airport to nearby Modlin Airport, which temporarily closed while authorities searched the aircraft. Two flights bound for Sofia, from Milan Bergamo and Dublin, received bomb threats, according to the Bulgarian Transport Ministry; the Wizz Air flight from Italy was carrying 176 passengers and the Ryanair flight from Ireland had 186 people on board. Both landed safely and no explosive devices were found on inspection.

In Italy, two Ryanair flights bound for Rome, from Lisbon and Dublin, were searched following bomb threats. Two Italian Air Force Eurofighter jets escorted the Ryanair flight from Dublin to Rome Fiumicino before it landed safely. A Scandinavian Airlines flight from Copenhagen was searched after landing in Warsaw. In south-eastern Spain, parts of Murcia Airport were cordoned off after a bomb threat was reported on a Ryanair flight from Manchester; all 121 people on board disembarked while police officers and sniffer dogs inspected the aircraft and its baggage, and officials later determined that the threat was a hoax.

The wave extended beyond aviation. The Panama-flagged cruise ship Crown Iris, operated by the Israeli company Mano Maritime and carrying about 1,500 passengers and crew, was evacuated while anchored off the Greek island of Syros after an unknown person claimed an explosive device had been attached to its hull. An explosives detection dog and a diver searched the vessel, and initial inspections found no explosives. The ship was bound for Haifa, Israel, and was expected to resume its voyage after further checks by coastguard specialists.

The incidents began even earlier in the week. On Monday 2 November, a Wizz Air flight from London Luton to Sofia was diverted to Budapest after receiving a bomb threat while airborne, and a Hungarian Gripen fighter jet escorted it. The Sun reported that the majority of Tuesday’s threats were sent to airlines via anonymous emails.

The British government called Tuesday’s threats “malicious hoaxes”, according to The Guardian. No group has claimed responsibility for any of the threats this week, and officials have not blamed anyone. Rhys Jones, analysis output manager at aviation risk advisory firm Osprey Flight Solutions, said that seven confirmed bomb threats in a single day affecting flights was exceptional.

No attribution — but a familiar pattern

While no country has attributed blame for the threats, they come at a time when European officials have been blaming both Russia and Iran for what they describe as “hybrid attacks” and acts of sabotage, according to Reuters. Moscow and Tehran both deny any such campaign.

Matthew Borie, chief intelligence officer at Osprey Flight Solutions, told the Associated Press that Russia was a key focus of his team’s work on the threats, and told The Sun that “Russian hybrid warfare targeting aviation is a real threat.” Borie outlined several possible explanations for the wave, including copycat incidents, an individual or group making multiple threats, or state-backed hybrid warfare operations. There is currently no evidence establishing that the bomb threats against passenger flights this week are part of any such operation, and the BBC has reported that officially there is no link between the threats, although authorities from various countries will co-operate to assess whether this was a co-ordinated attack designed to disrupt airspace.

Eliran Almog, chief executive of aviation cybersecurity firm Cyviation, said the repeated threats could serve both to disrupt operations and to observe how airlines, airports and national authorities respond. “These aviation threats are also occurring in the same period as cyberattacks on supermarket refrigeration systems across Europe,” Almog told Reuters. “Different essential services are experiencing disruption that carries economic costs and can undermine public confidence.”

That parallel disruption is real. This week, unidentified hackers shut down refrigerators and freezers in supermarkets in several European countries. Around 40 Delhaize supermarkets in Belgium and Luxembourg were hit, along with a smaller number of stores in Sweden, Ireland, the Netherlands, Estonia and Finland, and monitoring reports put the affected countries at nine, adding Portugal and Italy. No group has claimed responsibility for that attack either.

The wider grey-zone campaign

The bomb threats land in a European security environment that has grown steadily more tense through 2026, with a series of incidents that governments and analysts describe as grey-zone or hybrid warfare — hostile acts designed to stay below the threshold of open armed conflict while still imposing costs and sowing fear.

In early August, a small drone armed with Semtex failed to arm and explode after striking a Ukrainian Antonov aircraft parked on an isolated apron at Leipzig airport in Germany, and a second drone collided with a cargo aircraft, forcing an emergency landing. Germany later said Russia was behind the Leipzig airport drone attack, according to the BBC. The episode illustrated what analysts describe as Russia’s willingness to conduct higher-risk hybrid attacks on European logistics hubs, aimed at punishing supporters of Ukraine’s defence and disrupting a major hub for German and global support to Kyiv.

A report by the International Institute for Strategic Studies, published in July, analysed 144 drone incidents in 13 European states between August 2024 and February 2026 and concluded that it was “highly likely” the Kremlin ran a co-ordinated unmanned aerial vehicle campaign over the continent. Roughly 48 per cent of the sightings occurred over military facilities, 18 per cent over civilian airports and 26 per cent over ports and energy sites, with Germany alone logging 58. The report, first detailed by The Guardian and The Times, said Russian-linked vessels served as launch and recovery platforms, sailing close to European coastlines with their AIS transponders switched off.

The strongest evidence in that report was a single February 2026 event in the Öresund Strait. While the French aircraft carrier Charles de Gaulle was docked at Malmö during NATO’s Baltic exercises, a Swedish Navy patrol vessel spotted a drone that had taken off from the Russian signals-intelligence ship Zhigulevsk, then jammed it about seven nautical miles from the carrier. Swedish Defence Minister Pål Jonson confirmed the drone could be of Russian origin. It remains the only incident in the entire campaign publicly tied to a specific Russian platform.

The pressure has not let up in recent days. On 3 November, satellite navigation interference hit almost the entire length of NATO’s eastern border in a single day, according to a map of aircraft data published by the Italian flight-tracking project ItaMilRadar. The heaviest disruption ran in a nearly continuous band from the southern Baltic Sea through Lithuania, eastern Poland, Romania and Bulgaria to the western Black Sea. The map, built with data from AirNav Radar, shows where aircraft reported degraded GPS and other satellite navigation signals during the day. No government has said who caused the interference, and part of it may come from counter-drone jamming that NATO countries use to push satellite-guided drones off course before they reach their territory.

On 2 November, Poland launched a special security operation along its border with the Kaliningrad region. Prime Minister Donald Tusk said Polish and allied intelligence pointed to possible sabotage or armed provocations in the first half of November, including attempts by armed people to enter Polish territory. In Latvia, the armed forces twice warned of airspace threats near the Russian and Belarusian borders on 1 and 2 November and told residents in the area to take shelter; the second alert came with NATO Air Policing fighters scrambled. In September, a Russian drone flew deep into Romania before crashing in Moldova.

At the same time, caution is warranted. Not every sighting in this anxious period has turned out to be hostile. Danish police closed a nine-month probe in June without confirming a single drone over Copenhagen Airport, and Belgium’s own public broadcaster found no hard evidence of hostile drones there, catching the defence minister passing off footage of a “large drone” that turned out to be a police helicopter. The distinction between confirmed incidents, such as Leipzig, and unproven sightings matters — and it is exactly the distinction investigators must now draw with this week’s bomb threats.

Why a hoax still works

The defining feature of this week’s threats is that none of them needed to be real to work. Aviation security protocol treats every bomb threat as genuine until it is proven otherwise, and the response is the same whether or not a device exists: fighter jets scramble, aircraft divert to the nearest suitable airfield, passengers are evacuated, bomb squads search the cabin and cargo hold, and airports close runways and gates while the checks run their course.

Each of those steps costs money and time. A fighter jet scramble burns fuel and flying hours and pulls a military aircraft from its standing task. A diversion strands hundreds of passengers, forces airlines to re-accommodate them, disrupts crew schedules and aircraft rotations, and can cascade into delays across a network for the rest of the day. An airport closure, even a brief one, ripples through departure boards across a continent. When the threat arrives by anonymous email, as The Sun reported was the case for most of Tuesday’s alerts, the cost of sending it is effectively zero.

That asymmetry is precisely what makes hoax threats attractive as a tool of disruption, whether they are the work of a state, a group or a lone individual. The sender pays nothing; the target pays for jets, searches, delays and lost confidence. And the effect compounds with repetition: the first wave on Tuesday forced authorities to treat every subsequent alert with the same seriousness, because the one time a threat is dismissed could be the time it is real. By Thursday, the system was responding at full tempo to its second wave in three days.

There is also an intelligence value in repetition, as Almog suggested: each wave reveals how airlines, airports and national authorities respond, how quickly jets launch, which airfields accept diversions, and how long searches take. That information is useful to anyone planning a more serious disruption later — and it is gathered without the sender ever having to build a bomb.

Analysis: Why It Matters

1. The threat is the disruption

The most important fact about this week is also the most easily missed: nothing exploded, nobody was hurt, and no device was found on any aircraft. Yet flights were diverted across a continent, fighter jets were scrambled three days running, an airport closed, a cruise ship was evacuated, and hundreds of thousands of travellers had their journeys thrown into doubt. That is the point. A hoax bomb threat is not a failed attack; it is a successful one, measured by the disruption it causes rather than the damage it inflicts. Whoever is behind this wave has discovered — or rediscovered — that European aviation can be brought to a standstill with an email.

2. The pattern is the story, not any single flight

Taken alone, any one of these threats could be dismissed as a prank or a copycat. Taken together, they form a pattern that is hard to ignore: at least 20 flights in four days, across at least ten countries, hitting the same airlines and the same routes, alongside a cyberattack on supermarket refrigeration in nine countries and satellite navigation interference along NATO’s entire eastern flank on the same day. No single incident proves co-ordination. But the clustering — in time, in method and in target — is exactly what analysts look for when they assess whether a campaign is under way, and it is why Osprey Flight Solutions described seven threats in a single day as exceptional. The investigation now under way across several countries will matter more than any single incident.

3. Attribution is the hardest question — and the most important

No government has attributed blame, and that restraint is itself significant. Attributing a hybrid attack is difficult by design: anonymous emails leave few fingerprints, and the sender’s deniability is the whole point of the method. But the absence of attribution also creates a political problem. If European governments conclude, privately, that a state is behind the threats and say nothing publicly, the attacks can continue without cost to the sender. If they accuse a state without proof, they risk a diplomatic crisis built on suspicion. The space between those two options — quiet investigation, shared intelligence, co-ordinated response — is where this story will be decided in the coming weeks. The public should expect a long silence, and should not mistake it for inaction.

4. Civil aviation is now a front line

For decades, the security of European air travel was understood mainly in terms of terrorism: a bomb on a plane, a hijacking, an attack on an airport. This week’s events point to a different model, in which civil aviation is treated as infrastructure to be disrupted rather than as a target to be destroyed. The same logic applies to the supermarket freezers, the GPS jamming and the drone over Leipzig: none of these is an act of war in the classical sense, yet together they amount to a sustained campaign against the systems Europeans rely on every day. That shift has real consequences. It means aviation security can no longer be measured only by what is found on an aircraft; it must also be measured by how quickly the system recovers, how much disruption it can absorb, and how much confidence the travelling public retains when the alerts keep coming.

5. The public’s confidence is the real target

Ultimately, the audience for a wave of hoax threats is not the airlines or the air forces; it is the millions of people who read the headlines and wonder whether it is safe to fly. Each diverted aircraft and each scrambled fighter jet is a photograph and a headline, and the cumulative effect is a slow erosion of the assumption that flying in Europe is routine and safe. That erosion is difficult to measure and harder still to repair. The reassuring facts — that no device was found, that every aircraft landed safely, that the system worked exactly as designed — are true, and they deserve to be stated clearly. But they do not undo the image of a passenger jet being escorted by a fighter to a military base. Restoring confidence will take more than safe landings; it will take answers about who did this and why, and a visible demonstration that the people responsible have been stopped.

What to Watch Next

1. The investigation: whether police and intelligence services in France, Bulgaria, the Czech Republic, Poland, Italy and the UK can establish a link between the threats — a common sender, a shared email service, a pattern in the wording — and whether any arrests follow. The first official statement attributing blame, or ruling out a link, will be the most important development of this story.
2. Friday’s flights: whether the threats continue into a second week. A third wave would confirm that this is a sustained campaign rather than a burst of copycat activity, and would force airlines and governments to consider longer-term changes to how threats are handled.
3. The supermarket cyberattack: whether investigators identify who shut down the refrigeration systems, and whether any link to the aviation threats emerges. A shared culprit would transform two separate stories into one.
4. European co-ordination: whether the EU and NATO produce a joint response — shared threat intelligence, common protocols for handling aviation alerts, or new measures against the anonymous email services used to send the threats.
5. The cost: what airlines and airports report in lost revenue, compensation claims and extra security spending, and whether insurers and regulators begin to treat hoax threats as a systemic risk to European aviation rather than a series of isolated incidents.

Sources

• Reuters, “New wave of bomb threats hits passenger flights across Europe”, The Business Standard, 5 November 2026
• Reuters, “Bomb threats on flights, cruise ship cause disruption in Europe, no devices found”, SRN News, 3 November 2026
• The Times, “European flights diverted as at least 12 planes face ‘bomb threats’”, 5 November 2026
• LaPresse, “Bomb threats reported on eight flights across Europe this morning”, 5 November 2026
• Foreign Policy Research Institute, “Drone Defense And Deterrence Questions In Germany”, Europe Says, 2026