Hoax Bomb Threats Disrupt Dozens of Flights Across Europe as Fighter Jets Escort Airliners and Police Find No Explosives

Introduction

For three days in the first week of November 2026, a wave of emailed and phoned-in bomb threats swept across European aviation, forcing passenger jets to land early, divert to unfamiliar airports and fly the final stretch of their journeys under fighter-jet escort. By the end of Thursday, November 5, authorities said nearly 30 flights had been targeted in a single day, in what officials in several countries described as a coordinated campaign of hoaxes. Every aircraft landed safely. Every search came back empty.

The disruption was remarkable not for any single incident but for its scale and its spread. Flights departing Copenhagen, Dublin, Helsinki, Madrid, Milan, Warsaw, London, Rome and Athens were among those named in threats, and airports from Prague to Sofia to Lisbon found themselves receiving aircraft they had not expected. Runways were closed for inspections, passengers were moved to replacement planes, and air forces in at least three countries scrambled jets to meet civilian airliners in the sky.

What made the episode harder to explain was how little anyone could say about who was behind it. No government had named a suspect, no group had credibly claimed responsibility, and the threats themselves arrived in different forms — emails, anonymous calls — carrying different signatures. The one detail on which every authority agreed was that nothing dangerous had been found on any aircraft, and that the threats, whatever their source, had been hoaxes, which is why this week’s Europe hoax bomb threats flights November 2026 episode is now being treated as a security and policing problem rather than a terrorism case.

1. What happened on Thursday, the worst day so far

Thursday, November 5, was the day the scattered threats of the early week hardened into something that looked like a campaign. Reports from the Associated Press and other wire services put the day’s total at nearly 30 flights targeted by the end of the day, a sharp escalation from the handful of incidents reported on Monday and Tuesday. The threats arrived across the morning and afternoon, hitting airlines that had nothing in common except that they were flying over or into Europe, and they forced a pattern of emergency responses that repeated itself from country to country: a threat received, a diversion ordered, a search carried out, nothing found.

The scale mattered because it changed how the story was understood. A single hoax threat against a single flight is a familiar, if serious, policing headache. Nearly 30 in one day, spread across a dozen countries and at least six airlines, looked instead like a deliberate effort to stretch Europe’s aviation security system and to test how quickly it could absorb repeated false alarms. Officials were careful not to jump to conclusions in public, but the numbers alone were enough to push the story to the top of news bulletins across the continent.

1.1 Nearly 30 flights targeted in a single day

The count itself was still moving when Thursday ended. The Associated Press reported that bomb threats had targeted more than a dozen flights in Europe on Thursday, with at least eight flights from Copenhagen, Dublin, Helsinki, Madrid, Milan and Warsaw confirmed to have been targeted. Other reporting, drawing on police and aviation sources across the continent, put the total for the day at nearly 30 flights by Thursday evening, including aircraft that were searched after landing as scheduled rather than diverted. The difference between the confirmed count and the higher total reflected how the threats were arriving: some were reported immediately by airlines and airports, while others only became public as police in each country released their own figures.

What the figures agreed on was the direction of travel. Tuesday had brought at least seven targeted flights and a cruise ship. Thursday brought several times that number. And Friday morning brought still more, with a Ryanair flight from Rome to Lisbon searched after landing and fresh threats reported over France, around Copenhagen and around Prague. The pattern was not a single spike but a rising curve, and it was the curve, as much as any single incident, that alarmed aviation authorities.

1.2 How the threats arrived

The threats did not arrive through a single channel. Some came by email, sent to airlines and airports, and at least one email reviewed by the Associated Press was sent on behalf of a group that described itself as anti-feminist, according to an airport official who shared a copy. Others came by anonymous telephone call, including the call to the Rome control tower on Friday morning that warned of an explosive device aboard a Ryanair flight bound for Lisbon. Spanish police said three emailed threats arrived within 20 minutes of one another, involving one Air Europa departure from Madrid to Paris and two inbound Iberia flights from Rome and Milan.

The variety of channels made the threats harder to trace and harder to dismiss. An emailed threat can be routed through servers in several countries before it reaches its target. An anonymous call leaves even less to work with. And when threats arrive in clusters, as the Spanish example showed, security teams have to treat each one as live until it is proved otherwise, which means searches, delays and diversions even when every previous threat that day has turned out to be false. That is the logic of a hoax campaign: each individual threat costs little to make, but each one costs a great deal to answer.

2. The flights caught in the scare

The list of affected flights reads like a map of European short-haul aviation. Ryanair, Wizz Air, Finnair, LOT Polish Airlines, Scandinavian Airlines, Aer Lingus, Air Europa, Iberia, easyJet and Air Serbia all had aircraft named in threats during the week, and the routes involved stretched from the Atlantic coast of Ireland to the Black Sea coast of Bulgaria. No single airline bore the brunt of the campaign, and no single route was hit twice in the same way, which made it difficult for any one carrier to treat the problem as its own.

For the passengers on board, the experience was the same regardless of the airline. A routine flight became an unscheduled stop, a wait on the tarmac, a search of the aircraft and their luggage, and then a delayed arrival or a transfer to another plane. Airlines and airports were at pains to say that safety procedures had worked as designed, and in the narrow sense that was true: nobody was hurt, and no aircraft was damaged. But the disruption was real, measured in missed connections, ruined schedules and hours spent waiting for the all-clear.

2.1 Ryanair’s Sofia-bound flights

Bulgaria became one of the focal points of Thursday’s disruption. Three Ryanair flights bound for Sofia received bomb threats and military escorts, officials said, and all three had to make emergency landings. Two of the flights, one from Copenhagen and one from Madrid, landed safely in Sofia itself, airport officials told reporters. The third, from London, was diverted and landed safely in Plovdiv, Bulgaria’s second city, according to the chief executive of Plovdiv Airport, Krassimir Peshev. Bulgaria’s air force said its fighter jets had escorted three airliners to the ground.

Sofia was not a new target. On Monday, a Wizz Air flight from London’s Luton Airport to Sofia had received a bomb threat in midair and been diverted to Budapest, and a Wizz Air flight from Bergamo in Italy was inspected after landing in the Bulgarian capital on Tuesday. The repeated focus on Sofia-bound flights raised questions in Bulgarian media about whether the city’s airport, or the routes into it, had been singled out, but officials offered no public explanation for the pattern. What was clear was that Bulgarian authorities had by Thursday built a routine for the incidents: escort, land, search, clear.

2.2 The Dublin–Rome diversions

The Dublin to Rome route was hit twice in two days, in two different ways. On Tuesday, two Italian air force Eurofighter jets escorted Ryanair Flight FR9611 from Dublin into Rome’s Fiumicino Airport, where it landed at 10:45 in the morning, the airport’s operator said. On Thursday, an Aer Lingus flight from Dublin to Rome was diverted to a military air base in France after receiving a threat, the office of French Prime Minister Sebastien Lecornu said. French reporting added that fighter jets had been sent to intercept the aircraft and escort it to the air force base at Evreux after the pilot did not cooperate with authorities as expected.

The two incidents showed how differently the same threat can play out. In the first, the aircraft continued to its destination under escort and landed at a civilian airport. In the second, the aircraft was taken to a military base, a far more disruptive outcome for the passengers and crew. The difference may have come down to where the aircraft was when the threat was received, how much fuel it had, and what the authorities in the country underneath it decided. But for travellers watching the story unfold, the contrast was a reminder that a hoax threat does not produce a standard response: the response depends on the judgement of whoever is in charge at the moment the call comes in.

3. Fighter jets in the sky

One of the most striking images of the week was also one of the most unusual: military fighter jets flying alongside civilian airliners over Europe in peacetime, not because of a hijacking or a lost aircraft but because of an emailed threat. Italy, France and Bulgaria all sent jets up during the week, and in each case the escort ended the same way, with the airliner landing safely and the search finding nothing. The escorts were a measure of how seriously the threats were taken, and also a measure of how expensive they were to answer.

Fighter escorts are not routine. They require jets to be scrambled, fuel to be burned, and air traffic to be cleared, and they put military pilots into close formation with aircraft full of civilians. That European air forces were willing to do it repeatedly, across several days, said something about the threat picture they were seeing. It also said something about the cost of the hoax campaign: every escort consumed military resources that had been allocated for other purposes, and every one of them ended with the same empty result.

3.1 Italy’s Eurofighter escort

Italy was involved in two of the week’s most widely reported escorts. On Tuesday, two Eurofighter jets escorted the Ryanair flight from Dublin into Rome, a mission that ended with a normal landing at Fiumicino and a search that found nothing. On Thursday, the Italian air force escorted a Finnair flight that had departed Helsinki bound for Rome after a threat was received by email, the air force said in a statement. Finnair said its Flight 1761 from Helsinki to Rome had been targeted, and Finnish broadcaster Yle reported that nothing out of the ordinary was found after it landed in the Italian capital.

The Italian response was notable for its speed and its visibility. Fighter jets are a very public answer to a threat, and their presence over a civilian airliner is impossible to hide from the passengers looking out of the windows. That visibility may have been part of the point: an escort tells everyone watching, including whoever sent the threat, that the state is taking the matter seriously. But it also turns a hoax into a spectacle, and the spectacle is part of what makes hoax campaigns attractive to the people who run them.

3.2 France, Bulgaria and the military response

France’s involvement came through the Aer Lingus diversion, where the prime minister’s office confirmed that fighter jets had been sent to intercept the Dublin to Rome flight and escort it to the military base at Evreux. The same office confirmed on Friday that bomb threats had been made against four aircraft in French territory that day, and that all four had landed safely while security services investigated the devices claim and the broader campaign behind the threats. The French response therefore moved within a day from handling a single diverted flight to acknowledging a multi-aircraft incident.

Bulgaria’s air force, for its part, escorted three airliners to the ground on Thursday, a substantial commitment for a smaller air force. The three Ryanair flights it shepherded down were all bound for the same city, and the escorts were the visible end of a chain of decisions that began with an emailed or phoned threat and ended with a search on the ground. In all three countries, the military answer was the same: get the aircraft down safely, search it thoroughly, and say nothing about who was responsible until the evidence allows it.

4. Airports on alert across the continent

While the fighter jets drew the attention, the quieter work was happening on the ground, where airports across Europe spent the week receiving aircraft they had not expected, closing runways for inspections, and searching planes and luggage. Warsaw, Prague, Copenhagen, Madrid, Vienna, Bucharest and Lisbon were all drawn into the week’s incidents, and each airport had to make its own decisions about how much disruption a single threat justified. The result was a patchwork of responses that reflected local rules, local resources and local judgements about risk.

The airports that handled the threats best were often the ones that had dealt with them before. A bomb threat against an aircraft is not a new problem for European aviation, and the procedures for searching a plane, isolating it on the tarmac and clearing it for service again are well rehearsed. What was new this week was the volume: procedures designed for an occasional incident were being run several times a day, in several countries at once, and the strain showed in the delays and the diversions.

4.1 Warsaw, Prague and Copenhagen

Poland’s experience showed both sides of the week’s story. On Tuesday, two Warsaw-bound flights were targeted. Scandinavian Airlines Flight SK751 from Copenhagen landed without incident at Warsaw Chopin Airport, which closed a runway while the plane was inspected, and a LOT Polish Airlines flight from London’s Heathrow, which had also been due at Chopin, was diverted to the city’s second airport, Warsaw Modlin, which was closed after the alert. The plane, a Boeing 737 Max, landed safely and nothing was found. On Thursday, a LOT flight from Warsaw to Paris was stopped as it taxied towards take-off, and its passengers were transferred to another plane. A Wizz Air flight from Milan to Warsaw was diverted to Vienna.

In the Czech Republic, police said they had deployed officers at Prague’s Vaclav Havel Airport to prepare for the landing of four planes after receiving a threat of explosive devices on board. On Friday, Czech police posted that a threat to place an improvised explosive device on aircraft using Prague Airport was being repeated, and added that security measures were carrying minimal impact on normal operations. In Denmark, police said two planes had been searched at Copenhagen airport, and on Friday morning officers were present at the country’s largest airport while investigations continued, although the airport said operations ran normally. The three capitals illustrated the range of responses: a runway closed here, a precautionary presence there, a search completed with minimal disruption somewhere else.

4.2 Spain, Romania and the wider map

Spain’s airports were drawn in on Thursday, when the national airport operator Aena said it had activated an emergency protocol due to a bomb alert on a Ryanair flight from Manchester. Spanish police added the detail that three emailed threats had arrived within 20 minutes, involving one Air Europa departure from Madrid to Paris and two inbound Iberia flights from Rome and Milan. The 20-minute window suggested a single sender working quickly through a list, rather than three separate incidents, and it was one of the details that fed the suspicion of coordination.

Romania’s intelligence agency said a KLM flight to Tel Aviv with a layover in Bucharest had received a bomb threat, extending the map of affected countries further east. Portugal joined the list on Friday, when the Ryanair flight from Rome to Lisbon landed under police guard after an anonymous caller warned the Rome control tower of an explosive device on board. Flight FR8196 had left Rome Fiumicino minutes behind schedule at 5:48 in the morning and touched down in Lisbon at 8:27, 32 minutes late, while officers checked the aircraft and found nothing dangerous. Police also checked the return leg, Ryanair flight FR8197 from Lisbon to Rome, after a separate anonymous threat, and again found nothing suspicious. By the end of the week, the map of affected airports stretched from Lisbon to Bucharest and from Copenhagen to Sofia.

5. A week of threats, not a single incident

One of the mistakes it would be easy to make about this story is to treat Thursday as the whole story. It was not. The threats began earlier in the week, built through Tuesday, peaked on Thursday, and were still arriving on Friday morning. Understanding the week as a whole matters, because the pattern across the days is the strongest evidence available that the threats were connected, and because the earlier incidents show that the aviation system was already on alert before the worst day arrived.

The week also shows how a hoax campaign can grow. Each threat that is answered with a full security response demonstrates to the sender that the system works as they expect it to: the plane lands, the jets fly, the airport closes a runway, the news reports it. That feedback loop is part of what makes the campaign hard to stop. The sender learns that the threats work, and the authorities learn that they cannot afford to ignore the next one, however many false alarms have already come in.

5.1 Monday and Tuesday: the first wave

The week began on Monday, when a Wizz Air flight from London’s Luton Airport to Sofia received a bomb threat in midair and was diverted to Budapest. On Tuesday, the threats multiplied: at least seven flights and an Israel-bound cruise ship were targeted, according to officials, and all of the planes landed safely while searches found no explosives. The airlines affected on Tuesday included Ryanair, Wizz Air, Scandinavian Airlines and the Polish carrier LOT. In the United Kingdom, London’s Metropolitan Police said it had been made aware of threats against four aircraft due to depart from or arrive at Heathrow Airport, one of Europe’s busiest hubs.

Tuesday’s incidents already contained most of the elements that would define the rest of the week: a threat received in the air, a diversion or an escort, a search, nothing found. What Tuesday did not yet have was the volume. The difference between seven flights and nearly 30 is not just a matter of counting: it is the difference between a bad day and a campaign, and it was the volume on Thursday that pushed officials in several countries to start talking publicly about coordination.

5.2 The cruise ship and the pattern

The cruise ship targeted on Tuesday is easy to overlook, but it may be one of the most telling details of the week. A threat against a ship does not fit the pattern of a dispute with a single airline, and it does not fit the pattern of a grudge against a single airport. It fits a pattern of someone, or some group, working through a list of transport targets and testing which ones respond. The ship, like the aircraft, was searched and nothing was found, and no one claimed responsibility.

The cruise ship also widened the question of who the intended audience was. A threat against an aircraft is, in the first instance, a message to the airline and the airport. A threat against a cruise ship, on the same day as threats against seven flights, looks more like a message to the public and the press: a demonstration that the sender can reach into more than one kind of transport, and that the disruption can be spread wider than aviation alone. Whether that reading is right is something only the investigation can settle, and the investigation has so far said very little.

6. What officials are saying — and not saying

The public statements from officials during the week shared a careful tone. Nobody was hurt, nothing was found, and the threats were hoaxes: those three facts were repeated by authorities in every country involved. Beyond that, the statements diverged. Some officials spoke of coordination. Some spoke of a campaign. Some said nothing at all about who might be responsible, and none of them named a suspect. The gap between what was said and what was left unsaid became part of the story.

The most direct public characterisation came from Britain. Transport Secretary Heidi Alexander told British broadcasters that flights across Europe had been hit by what she called malicious hoax threats, a phrase that was picked up and repeated across European media. The word malicious mattered: it framed the threats not as pranks or mistakes but as deliberate acts intended to cause fear and disruption, even though no explosives had been involved.

6.1 ‘Malicious hoaxes’ and the coordinated-campaign question

The question of coordination was raised most directly by Irish authorities. On Friday morning, Irish officials described the threats as a likely coordinated campaign, after bomb threats had also been made against Irish media organisations. The statement, reported by The Guardian, noted that hoax threats against media and transport infrastructure cause fear, distress and disruption, and it was the first time an official source had publicly used the language of coordination rather than coincidence. The Irish statement mattered because Ireland had been drawn into the week’s incidents through the Dublin departures, and because it connected the aviation threats to a wider pattern of hoax threats against other kinds of target.

Other officials were more cautious. The French prime minister’s office said security services were investigating the devices claim and the broader campaign behind the threats, a formulation that acknowledged the possibility of a campaign without asserting it as fact. Czech police, posting about a repeated threat against Prague Airport, said simply that security measures were in place and that the impact on normal operations was minimal. The caution was understandable: coordination is a claim about intent and organisation, and it needs evidence, not just a pattern, to support it. But the pattern itself was becoming hard to ignore.

6.2 Who might be behind it

No government has said who was behind the threats, and no claim of responsibility has been verified. That absence of attribution is itself one of the notable features of the week. In most aviation incidents of this kind, the question of who is responsible is answered quickly, or at least narrowed down. Here, after three days and dozens of threats, officials were still saying they did not know, and the reporting reflected that uncertainty.

Some experts quoted in the coverage suggested that hoax bomb threats could be part of a similar pattern of low-cost, deniable disruption efforts, the kind of activity that is cheap to carry out, hard to attribute, and effective at forcing a costly response. The email sent on behalf of a group describing itself as anti-feminist, reviewed by the Associated Press, offered one possible lead, but a self-description in a threat email is not evidence of who actually sent it, and officials did not treat it as such. Until investigators can trace the emails and the calls, the question of who is behind the campaign remains open, and every theory about it should be treated as speculation rather than fact.

7. What it means for passengers and airlines

For the airlines, the week’s threats were a costly exercise in doing everything right. Each threat required a decision, a diversion or an escort, a search, and a delay, and each of those steps cost money: fuel, crew time, airport fees, compensation for missed connections, and the expense of searching aircraft and luggage. None of that cost is recoverable from the person who sent the threat, and the airlines have no way of knowing whether the next threat will be another hoax or something worse, which means they cannot safely economise on the response.

For passengers, the cost was measured in time and in worry. A diverted flight is not a minor inconvenience when it lands in a different city, and a wait on the tarmac while police search an aircraft is not something that leaves people unaffected, even when the search finds nothing. The airlines and airports involved were careful to say that safety procedures had worked, and that is true. But the week’s events were also a reminder that safety procedures are designed to protect people from real danger, and that a hoax can force the system to spend its resources on a danger that does not exist.

7.1 Delays, costs and the security bill

The financial cost of the week’s disruptions has not been published, and it may never be calculated in full, because it is spread across airlines, airports, air forces and police forces in a dozen countries. What is clear is that it was substantial. Fighter jets were scrambled in at least three countries. Runways were closed in Warsaw and at other airports. Aircraft were taken out of service for searches. Passengers were transferred to replacement planes, as happened with the LOT flight stopped on the taxiway in Warsaw, and in other cases passengers simply waited. Every one of those actions has a price, and the price was paid by the public and by the airlines, not by whoever sent the threats.

There is also a less visible cost, which is the strain on the people who have to answer the threats. Air traffic controllers, airport security staff, police officers and military pilots all had to treat each threat as real, knowing that most of them would turn out to be false. That is demanding work, and it is work that becomes harder, not easier, as the number of threats grows, because each false alarm makes the next one feel more routine, even though the consequences of missing a real one would be catastrophic.

7.2 What travellers should know

For travellers flying in Europe in the coming days, the practical advice from the week’s events is straightforward. Expect the possibility of delays, especially on routes that have already been targeted, and allow extra time for connections. Listen to the crew and to airport staff if a diversion or a search is announced, and understand that a search that finds nothing is the system working as it is supposed to, not a sign that something has gone wrong. Airlines will not always be able to explain in real time why a flight has been diverted, because the information they have may be incomplete or sensitive, but they will say what they can.

It is also worth remembering that the week’s threats, for all their scale, did not produce a single injury and did not damage a single aircraft. The system of escorts, diversions and searches that the threats triggered did what it was designed to do, which was to get every aircraft down safely and to check every one of them. That is a reassuring record, but it is not a reason for complacency: the threats are still arriving, and the investigation is still open, so the disruption may not be over yet.

8. What remains unconfirmed and what to watch next

Much about this week’s events is still unknown, and it is important to say so plainly. The identity of whoever sent the threats has not been established. The total number of flights targeted across the week has not been finally confirmed, because different countries have released different figures and some threats were only reported days after they were received. Whether the threats were coordinated by a single group, or whether they were the work of copycats following the first reports, has not been established. And whether the campaign is over, or whether more threats are coming, is something nobody can say with confidence.

What can be said is that the investigation is now a matter for police and intelligence services in several countries, and that the answers will come from their work, not from speculation. The coming days will show whether the threats stop, whether anyone is arrested, and whether the pattern that emerged this week was the beginning of something larger or an isolated episode that has now run its course.

8.1 The investigation and any arrests

No arrests have been reported in connection with the threats, and no government has said that it has identified the sender or senders. The investigation faces the usual difficulties of tracing emailed and phoned-in threats, which can be routed through multiple countries and disguised with simple technical measures. The email sent on behalf of a group describing itself as anti-feminist is one lead among others, but it is not proof of anything on its own, and investigators will need to corroborate it with technical evidence before they can say who was behind it.

The involvement of several countries means the investigation is, in practice, several investigations running in parallel, sharing information through the usual channels between European police and intelligence services. That cooperation takes time, and it may be some days or weeks before any public statement about suspects or arrests is made. Until then, the most honest description of the investigation is that it is active, that it is being treated seriously, and that it has not yet produced a public result.

8.2 What to watch next

The first thing to watch is whether the threats continue. Friday morning brought fresh incidents in Lisbon, over France, and around Prague and Copenhagen, which suggested that the campaign had not ended with Thursday’s peak. If the threats stop in the coming days, the episode may be remembered as a short, sharp disruption. If they continue, the question of how Europe’s aviation system absorbs repeated false alarms will become more pressing, and the pressure on investigators to find the source will grow.

The second thing to watch is what officials say next. The Irish description of the threats as a likely coordinated campaign was the most direct official statement of the week, and it will be worth watching whether other governments adopt the same language, and whether any of them is willing to name a suspect or a motive. The third thing to watch is the response from the airlines and the airports, which may have to decide whether their procedures for handling threats need to change, and whether the cost of answering hoaxes needs to be shared differently. The coming weeks will provide the answers.

Comments

comments