Europe’s airline bomb hoaxes: Why a threat that isn’t real still works

Europe’s airline bomb hoaxes: Why a threat that isn’t real still works
A screengrab from a video shows a police officer and a sniffer dog inspecting a Ryanair airplane and its baggage, after a bomb threat, Spain, 3 November 2026.
Reuters

A wave of bomb threats targeting passenger flights has disrupted air travel across Europe, forcing diversions, airport closures and fighter jet escorts. No explosives have been found, raising questions about who is behind the alerts and whether the disruption itself is the goal.

At least seven flights were targeted on Tuesday alone, according to Reuters. No one has claimed responsibility, and authorities have not publicly identified any suspects.

The incidents raise a wider question about aviation security: how should governments respond to threats that may be hoaxes but cannot safely be ignored?

What happened?

The alerts have affected multiple airlines across at least six European countries.

On Tuesday, two Ryanair flights were searched at Rome’s Fiumicino airport. The first, arriving from Lisbon, landed at 09:40 CET, followed by a flight from Dublin at 10:30 CET, which was escorted by the Italian Air Force.

Airport operator ADR said both aircraft, along with their luggage, passengers and crew, were searched before the alerts were cleared. It confirmed that the airport itself had not been threatened and other flights were unaffected.According to the Associated Press, both threats were sent by email.

In Spain, Murcia airport activated security protocols on 3 November following a bomb threat against a Ryanair flight from Manchester, regional government delegate Francisco Lucas said. All 121 people on board, including 114 passengers and seven crew members, disembarked for security checks while authorities searched the aircraft.

Bulgaria’s transport ministry reported threats against two flights: a Ryanair service from Dublin to Sofia carrying 185 passengers and a Wizz Air flight from Milan Bergamo with 176 people on board. Both landed safely, with searches finding no explosives.

The previous day, a Wizz Air flight from London to Sofia was diverted to Budapest under escort by a Hungarian Gripen fighter jet, Hungary’s defence minister said.

In Poland, a LOT flight from London made an unscheduled landing at Warsaw-Modlin airport, where operations were suspended until around midday as security teams inspected the aircraft. Passengers waited in the arrivals hall during the checks.

Meanwhile, an SAS flight from Copenhagen landed at Warsaw-Chopin airport for inspection. SAS confirmed the aircraft landed safely, while Polish authorities said the threat was unsubstantiated. The airport remained operational.

An SAS aircraft flying from Copenhagen lands, after receiving a bomb threat, at Warsaw Chopin Airport in Warsaw, Poland, 3 November 2026, 
Reuters

The incidents followed an earlier alert on 18 October, when an Austrian Airlines flight from Tel Aviv to Vienna was diverted to Sofia after a bomb threat was received as it flew over Romania, Bulgaria’s transport ministry said.

A Bulgarian MiG-29 fighter jet escorted the Airbus A320, which landed approximately 30 minutes later. All 51 passengers and six crew members were evacuated. No threat was found during the search, and the aircraft later continued to Vienna.

The threat as the weapon

What makes this wave of alerts particularly disruptive is not what security teams have discovered, but the scale of the response triggered by each warning.

Sending a threatening email costs virtually nothing. Yet the latest incidents have prompted military escorts in three countries, airport shutdowns, a runway closure and security checks involving hundreds of passengers.

Authorities have little room to take chances. Under aviation security procedures, every credible threat must be treated as potentially genuine until checks establish otherwise.

A Turkish Airlines plane is inspected by police after a false bomb threat following an emergency landing at Josep Tarradellas-El Prat Airport in Barcelona, Spain, 15 January 2026.
Reuters

This imbalance, where minimal effort can trigger an extensive and costly response, makes bomb hoaxes an attractive tactic for those seeking chaos rather than casualties.

Eric Schouten, head of aviation security firm Dyami, told Reuters that the pattern “does fit the narrative of Russian state actors who want to disturb Europe”.

However, he provided no evidence linking Moscow to the incidents.

A wider pattern

European officials have previously accused Russia and Iran of conducting “hybrid attacks” and sabotage operations across the continent. Both countries have denied the allegations.

Research suggests such activities have increased in recent years.

A March 2025 study by Seth G. Jones at the Center for Strategic and International Studies (CSIS) documented 34 Russian-linked attacks and plots in Europe in 2024, compared with 12 in 2023.

Transport infrastructure, including aircraft, accounted for 27 per cent of the targets. The report found that these operations generally caused few casualties, suggesting an effort to minimise costs while making responsibility harder to establish.

In February 2026, the Netherlands-based International Centre for Counter-Terrorism (ICCT) reported that Russia had been linked to at least 151 hostile operations across Europe since February 2022.

Its findings included only cases where attribution could be made with confidence, covering incidents such as drone incursions near airports and GPS jamming.

Crucially, neither study examined the latest bomb threats, and no authority has attributed the current incidents to a foreign government.

India's bomb hoax wave offers a warning

A similar crisis in India highlights the dangers of drawing conclusions before investigations are complete.

In 2024, the country's aviation industry was hit by a much larger wave of false bomb alerts. According to figures compiled from Indian media, 999 hoax threats had been recorded by mid-November.

Investigators traced some emails to a Russian IP address and Budapest, but suspects included a 17-year-old accused of using a fake social media account. Many of those responsible were never identified.

The experience demonstrated how widespread hoax campaigns can involve individual offenders, copycats and potentially organised groups, making it difficult to establish who is responsible. Investigations can take months, and some cases may never be solved.

A costly dilemma for European aviation

Investigations into the latest threats are continuing across several European countries. In Poland, police are examining the alert involving the SAS flight.

For airlines and governments, the challenge is clear: every warning demands a security response, even when the threat ultimately proves false.

But each diversion, evacuation or airport shutdown also demonstrates how easily air travel can be disrupted.

Until investigators identify those responsible, European aviation faces a difficult balancing act: protecting passengers without allowing anonymous threats to repeatedly bring flights to a standstill.

Read more:

Tags