Hoax bomb threats disrupted air travel across Europe on Thursday, November 5, 2026, forcing passenger jets to divert, land under military escort and undergo full security searches, in the second such wave to hit the continent’s aviation system in a single week.
At least 21 aircraft were targeted on Thursday, according to the BBC, while Reuters counted 25 or more flights affected by the afternoon. No explosive device has been found on any aircraft searched so far, and no one has been injured, according to the BBC and Al Jazeera. The threats continued into Friday, November 6, when they spread beyond aviation to media organisations, with the British broadcaster Sky saying it had received a security threat and Ireland’s RTE evacuating its Dublin building after a bomb threat.
The disruption is still developing, and authorities in several countries are investigating the source of the messages. What is clear is that every threat, however unlikely to be genuine, has to be treated as real — and that the cost of responding falls on airlines, airports, air forces and passengers.
What happened on Thursday
The worst-affected flight was Aer Lingus flight EI402, an Airbus A320 travelling from Dublin to Rome with 151 passengers and six crew on board. According to the BBC, air traffic control passed on a bomb threat to the aircraft, and it was diverted to the Évreux-Fauville air base in Normandy, northern France. The office of French Prime Minister Sébastien Lecornu said fighter jets had been sent to intercept the aircraft and escort it to the air base after the pilot did not cooperate with authorities as expected.
A Finnair flight from Helsinki to Rome, flight AY1761, was escorted into Rome’s Fiumicino airport by Italian Air Force jets. The airport operator, Aeroporti di Roma, said police bomb disposal checks found nothing on board.
Three Ryanair flights bound for Sofia — from Copenhagen, Madrid and London — were targeted, according to Bulgaria’s Ministry of Transport. Bulgarian air force jets escorted the aircraft, and one Ryanair flight from London to Sofia was diverted to Plovdiv, Bulgaria’s second city.
A Wizz Air flight from Milan Malpensa to Warsaw was diverted to Vienna in line with security protocols, the airline said. Nearly 200 passengers were evacuated from a Wizz Air flight from Milan to Bucharest after it landed at Henri Coandă International Airport, where an explosives team from Romania’s Intelligence Service inspected the aircraft.
Spanish police said three emailed threats arrived within 20 minutes, involving two Air Europa departures from Madrid to Paris and four inbound Iberia flights from Rome and Milan. An airport source in Italy told Reuters that an email with the subject line “Threat report” had been sent to airlines, airport operators and service providers at Rome’s Fiumicino and Milan’s Malpensa airports.
Britain’s Transport Secretary, Heidi Alexander, described the incidents as “malicious hoax threats”. Warnings received by London Heathrow and Birmingham airports were assessed as not credible, according to the BBC.
A week of disruption
Thursday’s wave was the second in three days. On Tuesday, November 3, at least seven flights and a cruise ship received hoax threats, again with no explosives found. On Monday, a Wizz Air flight from London to Sofia was diverted to Budapest after a threat.
On Friday, November 6, the threats reached media organisations. Sky, which is owned by Comcast, said in a statement read by a presenter on Sky News that it was one of a number of media organisations to receive a security threat, and that it had carried out a security assessment and reported the matter to the authorities. Irish broadcaster RTE evacuated its building in Dublin following a bomb threat, Reuters reported, and the offices of Newstalk and the Irish Independent group were also evacuated. A Ryanair flight from Rome to Lisbon was among the new threats recorded on Friday, and Czech police reported further bomb threats against aircraft at Prague Airport.
Who is behind the threats?
The threat emails were signed “Fighters of the Male State” and threatened to “turn the skies red” with explosions, according to the BBC and the Associated Press. The BBC reported that the name likely refers to the Russian group known as the “Male Legion” or “Muzhskoi Legion”.
No country has attributed blame for the threats to any person, group or state, and no one has claimed responsibility for the campaign as a whole. The threats come as many European officials are accusing Russia of masterminding sabotage and so-called “hybrid attacks”, often described as cheap, easily deniable and not expected to trigger an armed response. Denmark, Poland and Romania, all affected by Thursday’s disruptions, have previously accused Moscow directly of being behind hybrid attacks, while Germany blamed Russia for an August attack on Leipzig airport, according to Reuters.
Those accusations are claims by governments, not established findings about this week’s threats, and investigators have not publicly linked the emails to any state. The BBC reported that the first email it obtained was sent on Thursday at 07:21 under the subject line “Threat warning” to several offices of Aeroporti di Roma, written in fluent Italian, and that the sending address appeared to be linked to state health services in Bogota, Colombia. At least one of Friday’s warnings appears to have come by phone rather than email.
Why every threat is treated as real
Aviation experts say the system has no choice but to respond in full to each warning, however implausible it may seem. Marco Chan, a senior lecturer in aviation operations at Kingston University and a former Cathay Pacific pilot, told BBC Verify that the threats were most likely a hoax but that the system was right to treat them as real, given that sending one costs almost nothing while the response ties up airlines, airports and air forces.
That asymmetry is the point, according to security analysts: a single email can force a diversion, scramble fighter jets, evacuate hundreds of passengers and close runways, while the sender risks little. The cost falls on passengers, who face delays and missed connections, and on airlines and airports, which must absorb the expense of searches, diversions and disrupted schedules.
What happens next
Investigations are continuing in several countries, and European aviation authorities are reviewing how threat information is shared between airlines, airports and air forces. The repeated waves within a single week suggest the campaign may not be over, and officials have warned that a threat proving to be a hoax does not guarantee that a later one will be.
Sources
- Reuters — “New wave of bomb hoaxes hits at least 27 passenger flights across Europe” and “UK broadcaster Sky received security threat, as alerts sweep Europe” (November 6, 2026)
- BBC — “Hoax bomb threats disrupt more than 10 European flights for second time this week” and “New wave of bomb threats hit European airlines” (November 5–6, 2026)
- Associated Press — reporting on the threat emails and the first wave of threats (November 2026)
