At least 27 passenger flights suffered severe operational disruptions across European airspace on Thursday following a coordinated wave of bomb hoaxes. The incident prompted emergency diversions and landings, and triggered the deployment of military fighter jets to intercept and escort several aircraft, marking the second such occurrence within a single week.
Massive Disruptions in European Air Traffic
The operational emergency caused route diversions, ground security sweeps, and military scrambling across multiple European nations. While no government has directly attributed responsibility, the alerts come amid ongoing warnings from European authorities regarding sabotage and “hybrid attacks.”
This episode represents the second wave of threat alerts this week, following similar threats directed at least seven flights and a cruise ship on Tuesday.
Affected Airlines and City Pairs
Carriers named in the threat reports include Aer Lingus, Air Europa, Iberia, LOT Polish Airlines, EasyJet, Finnair, Wizz Air, Ryanair, and Air Serbia, impacting itineraries to and from hubs such as Madrid, Paris, Rome, Milan, Prague, Sofia, Vienna, Brussels, and Bucharest.
- Spain: Police confirmed the receipt of three email threats within a 20-minute window. The alerts affected two Air Europa departures on the Madrid–Paris route and four inbound Iberia flights originating in Rome and Milan. Multiple aircraft were held on the ground or returned to their parking stands at Adolfo Suarez Madrid-Barajas Airport (MAD) to deplane passengers and initiate security inspections.
- France: The office of Prime Minister Sebastien Lecornu confirmed that fighter jets were scrambled to intercept an Aer Lingus flight routing between Dublin and Rome, escorting it to Evreux-Fauville Air Base after the pilot did not cooperate as authorities expected; specific reasons for this behavior were not detailed.
- Bulgaria: The air force escorted three passenger airliners to safe landings. Among them, a Ryanair service operating between London and Sofia was diverted to Plovdiv, the country’s second-largest city.
- Poland: At Warsaw Chopin Airport, a Paris-bound LOT Polish Airlines aircraft was halted while taxiing to the active runway; passengers were disembarked and transferred to a replacement aircraft.
- Denmark: Danish police coordinated the screening and search of two aircraft at Copenhagen Airport.
- Romania: In Bucharest, counter-terrorism protocols were activated around a Wizz Air flight arriving from Milan. Passengers reported that the aircraft was isolated at a remote parking stand and surrounded by fire and rescue services, ambulances, and tactical response teams.
Modus Operandi and Threat Origin
In Italy, airport sources informed Reuters of an email bearing the subject line “Threat report,” distributed to various airline addresses, ground operators, and service providers across Rome Fiumicino and Milan Malpensa airports.
The text, attributed to self-styled “Male State fighters,” warned of explosive devices set to detonate within 60 minutes aboard flights arriving from Helsinki and Dublin. Independent verification of the material authorship and source of the broader continental threats has not yet been established.
Addressing crisis management procedures, Joji Waites, Head of Flight Safety at the British Airline Pilots’ Association (BALPA), stressed that airline operators do not enact operational threat protocols unless assessment bodies formally deem them credible.
Risk Assessment: Hybrid Warfare and Cybersecurity Vectors
The impact of these alerts has reignited intelligence concerns across Europe, where nations such as Denmark, Poland, and Romania have previously accused Moscow of conducting hybrid warfare operations. Additionally, Germany linked Russia to an incident at Leipzig Airport in August, while the United Kingdom previously pointed to Russian state involvement and connected Iran to a suspicious plot targeting a U.S. military installation. Both Russia and Iran have categorically denied involvement.
Aviation sector analysts and strategic intelligence firms provided technical assessments on the phenomenon:
- Geopolitical Drivers: Eric Schouten, head of aviation security consultancy Dyami, noted that the majority of targeted nations actively support Ukraine in the ongoing conflict resulting from the Russian invasion.
- Multiple Hypotheses: Risk analysts at Osprey Flight Solutions stated that a link to hybrid campaigns represents a “realistic possibility,” though they cautioned that other variables—including individual grievances or copycat actors—cannot be ruled out.
- Vulnerability Probing: Eliran Almog, CEO of aviation cybersecurity firm Cyviation, highlighted that these incidents serve both to disrupt standard flight operations and to benchmark the response times and defensive protocols of airlines, airports, and national defense agencies.
Almog drew temporal parallels between these aviation incidents and concurrent cyberattacks targeting refrigeration networks across European supermarket chains and French blood banks, observing that targeting critical infrastructure incurs immediate economic costs and aims to degrade public trust.
While intelligence and law enforcement agencies trace the electronic communications, European commercial aviation continues to operate under heightened threat detection and contingency frameworks to manage unscheduled disruptions.
Related Topics
Delta Faces Class Action Lawsuit Over Window-Seat Fees on Windowless Rows
American Airlines and the MICHELIN Guide Forge Partnership to Offer Exclusive Dining Experiences to AAdvantage Members
JetBlue Expands Fort Lauderdale Network with Nonstop Flights to Indianapolis and Columbus
TAP Air Portugal Launches Nonstop Flights Between Lisbon and Orlando
Plataforma Informativa de Aviación Comercial con 13 años de trayectoria.