SUMMARY / What are the scenarios in the case of the wave of bomb alerts that affected flights in Europe

Between October 30 and November 5, 2026, Europe experienced the most extensive wave of bomb threats targeting commercial aviation in recent years. According to NewsVibe monitoring, the subject generated 584 items in the monitored space, peaking at 249 publications on November 3 alone, with an overwhelmingly negative tone: 404 of the items were classified as negative. Behind the figures lies a succession of real incidents, involving diverted aircraft, closed airports, and fighter jets scrambled into the air, but with no explosives found after the checks.

How many flights were targeted and on which routesAt least nine commercial flights received bomb threats on three distinct days during the monitored period, although the figures vary depending on the source: Reuters spoke of “at least seven” targeted flights on Tuesday, November 3, while AFP, cited by Digi24, put the number at ten commercial flights on that day alone. The French publication L'Indépendant summed up the phenomenon in its headline: “nine aircraft in three days,” with Irish airline Ryanair “particularly targeted.”

The first major incident occurred on Monday, November 2, when a Wizz Air aircraft operating the London Luton–Sofia route was diverted to Budapest following a bomb threat received during the flight. A Hungarian Air Force Gripen fighter escorted the aircraft until it landed at Liszt Ferenc Airport, and checks revealed no suspicious object, Hungary Today and Mediafax report.

Tuesday, November 3, was the most hectic day. A Boeing 737 MAX 8 operated by Polish airline LOT, flying from London Heathrow to Warsaw with 181 people on board, was diverted from Chopin Airport to the secondary Warsaw-Modlin Airport, which was temporarily closed so the aircraft could be searched, The Independent and Biziday report. An SAS aircraft from Copenhagen, also bound for Warsaw, received a similar alert, according to the Daily Mail. In Rome, two Ryanair aircraft, one arriving from Lisbon and the other from Dublin, were searched at Fiumicino following anonymous reports, with the Dublin flight escorted to landing by the Italian Air Force, according to airport sources quoted by the BBC. Also that day, a Ryanair flight from Manchester landed as scheduled in Murcia, Spain, where 114 passengers and seven crew members were disembarked and checked, according to the Spanish government delegate in the region, quoted by WalesOnline. In Bulgaria, Transport Minister Georgi Peev confirmed threats against two aircraft arriving in Sofia, one departing from Dublin with 185 passengers and a Wizz Air flight from Bergamo with 176 people on board, according to the BTA news agency, cited by PBS News.

The wave ended on Thursday, November 5, with an Aer Lingus Airbus A320, flight EI420 from Dublin to Rome, diverted to the Évreux military air base in northern France after the crew transmitted the international emergency code 7700; the French prime minister’s services announced that the situation was being monitored “in real time,” The Guardian and Le HuffPost report.

Viewed as a whole, the targeted routes show a clear concentration: departures from the United Kingdom (London Heathrow, London Luton, Manchester), Ireland (Dublin, three times), Portugal (Lisbon), Denmark (Copenhagen), and Italy (Bergamo), to four destinations—Warsaw, Sofia, Rome, and Murcia. Five of the seven aircraft targeted on Tuesday belonged to Ryanair, with the remainder operated by LOT and SAS, L'Indépendant notes.

What explanations did the authorities give

All the threats proved to be false. Checks of passengers, luggage, and aircraft identified no explosive device, and all the airports concerned resumed normal operations, Agerpres reports, citing Reuters. No person or organization claimed responsibility, and officials did not indicate any possible perpetrators. The threats came through anonymous reports, and in the case of one of the flights arriving in Sofia, the initial information “was based on a pilot’s report,” Minister Peev explained.

The British government described the incidents as “malicious false threats,” emphasizing that the United Kingdom has “one of the most robust aviation security systems in the world,” with well-tested processes for such scenarios, according to the BBC. London’s Metropolitan Police said it was monitoring the situation through its aviation unit, while investigations opened across Europe will determine whether there was a coordinated action intended to disrupt the airspace, the BBC also notes.

Who was blamed: experts, the press, and denials from MoscowAlthough officials did not name any perpetrator, the media verdict was swift. The Daily Mail ran the headline that “Russia is suspected” of being behind the false alerts, amid fears that President Vladimir Putin could escalate a “shadow war” against Britain and NATO. Defense expert Stuart Crawford, a former lieutenant colonel in the British Army, assessed that the threats could be part of a “coordinated attack” by Moscow, designed to remain below the threshold of an act of war and impossible to prove, adding that European security services would probably have a clear idea of what was happening, but that time was needed to formally identify Russia as the perpetrator, the Daily Mail reports.

The most nuanced analysis came from Matthew Borie, co-founder and director of intelligence at Osprey Flight Solutions, which advises airlines on threats. Quoted by PBS News, he listed three hypotheses: a single threat triggering copycat incidents, an individual or group sending multiple threats, or “hybrid warfare” operations carried out by state actors or their supporters. “The fact that attention is focused on Europe means there could be a Russian component,” Borie said, while also warning that “Iranian hybrid warfare is equally active in certain areas of Europe.” Aviation security expert Paul Mason told BBC Radio 5 Live that such threats “do not happen very often,” and that transmitting them “in a credible way, to a wide range of airlines” suggests “a very deliberate act,” rather than a series of coincidental malicious calls.

The Romanian and international press placed the phenomenon in a broader context: several European officials have accused Russia and Iran of hybrid attacks and sabotage on the continent, ranging from hacking anti-aircraft alert applications to attacks on supermarket refrigerators and blood banks in France, while Moscow and Tehran have rejected the accusations, Mediafax and The Independent note. Moscow explicitly denied any involvement in the bomb alerts on aircraft, Antena 3 CNN reported. Investigations cited by the British press nevertheless specified that there is still no clear evidence that a hostile state was involved.

A phenomenon extending beyond aviation

The same days brought episodes showing that aviation was only one of the targets. A cruise ship carrying more than 1,500 people was stopped and searched in the Greek port of Syros following an anonymous bomb threat, 271 schools in Italy were evacuated after similar alerts, and blood banks in France were hit by a cyberattack. Also on Tuesday, an Air Serbia commercial flight on the Belgrade–Moscow route, carrying associates of former President Aleksandar Vučić, was turned back over Lithuania following a security alert and subjected to the checks required in the event of a possible bomb threat.

The monitoring conclusion is clear: Europe usually deals with false alerts, but rarely with so many, so concentrated in time and along the same routes. Until the investigations identify a perpetrator, one thing is certain: nine crews, hundreds of passengers, and four national air defense systems reacted exactly as procedures required—and that very reaction was probably the real target.