Hoax bomb threats force European flights to divert for a second time this week

What happened in the skies over Europe on Thursday?

On Thursday 5 November 2026, a second wave of hoax bomb threats in a single week swept across European aviation, forcing jets to divert, land under military escort and face full searches from Ireland to Bulgaria. At least 21 aircraft were targeted, according to the BBC, while a Reuters count put the figure at 25 or more by Thursday afternoon; and on every aircraft searched so far, nothing was found.

Flights bound for Austria, Belgium, Bulgaria, the Czech Republic, France, Italy, Poland and Romania were affected. An Aer Lingus flight from Dublin to Rome was diverted to a military air base in Normandy, a Finnair jet from Helsinki to Rome was escorted into the Italian capital by fighter jets, and three Ryanair flights bound for Sofia were walked to the ground by Bulgarian air force jets.

Britain called the incidents “malicious hoax threats”; Heathrow and Birmingham received warnings assessed as not credible. No one was injured, no flight was lost, and no government has named a suspect.

What the airlines and the authorities have confirmed so far

The sharpest episode was Aer Lingus flight EI402, an Airbus A320 flying from Dublin to Rome with 151 passengers and six crew on board. French fighter jets escorted it to the Évreux-Fauville air base, west of Paris, where passengers stayed on board for about two and a half hours while police and military personnel searched the aircraft with sniffer dogs. Emily Noble, a 26-year-old from Dublin travelling to a friend’s wedding in Rome, told the BBC that the pilot first spoke of a “technical” problem, then of a “security” issue.

Finnair said two of its flights faced “unfounded hoax bomb scares”: flight AY1761 from Helsinki to Rome, escorted by Italian Eurofighter jets into Fiumicino and checked by bomb disposal experts, and a Helsinki–Vienna service operated by the charter carrier Jettime, which landed normally. Wizz Air said its Milan–Warsaw flight diverted to Vienna after a hoax threat, while its Milan–Bucharest flight landed safely and was inspected on arrival. Three Ryanair flights bound for Sofia received military escorts, Bulgarian officials said; two from Copenhagen and Madrid landed in the capital as planned, while a third, from London, diverted to Plovdiv.

LOT said its Warsaw–Brussels flight landed as planned with nothing suspicious found, while its Warsaw–Paris flight was stopped before take-off for a full screening. EasyJet flights from Newcastle and Glasgow were met by police in Prague, one of four aircraft bound for the Czech capital that police said carried no explosives. Aegean said threats against its Thessaloniki–Milan and Athens–Vienna flights were unfounded, Air Serbia said its Belgrade–Bucharest flight landed safely, and a Ryanair flight from Porto was checked by bomb disposal experts on arrival in Milan. Most threats arrived by email.

Who sent the threats; and are the waves connected?

Nobody has claimed responsibility for the campaign as a whole, and no government has attributed the threats to any person, group or state. The one signature investigators do have comes from the Rome email, sent on behalf of a group or individual calling themselves “Fighters of the Male State”, claiming to target a “feminist regime” and threatening to “turn the skies red” with explosions. The email said devices had been placed on inbound flights from Helsinki and Dublin and would explode within 60 minutes. The Associated Press reviewed a copy provided by an airport official,

The BBC reported that “Fighters of the Male State” likely refers to the Russian group “Muzhskoi Legion”, or “Male Legion”; an ultra-right group with such extreme views that a Moscow court banned it in 2021, though it kept tens of thousands of online followers and cheered on the full-scale invasion of Ukraine the following year. Whether the three waves share a sender is also unsettled: a Wizz Air flight from London to Sofia was diverted to Budapest on Monday, at least seven flights and a cruise ship were targeted on Tuesday, and Thursday brought the largest wave yet. The European Union said it was not yet clear whether the alerts were connected.

Why a hoax can ground a continent's aviation

A bomb threat does not have to be real to work. Every warning must be treated as genuine until it is cleared, and that rule, the foundation of aviation security, is exactly what makes a hoax so powerful. Philip Baum, a professor of aviation security at Coventry University, told the BBC that the industry faces multiple bomb threats every single day, but that he had been “surprised” by this week’s incidents. A flight is diverted, he said, “only when the threat is credible and the authorities believe there is a potential of explosive device on board”

The cost falls on everyone at once. Airlines pay for fuel burned on diversions, crews pushed past their duty limits, aircraft pulled out of rotation and passengers rebooked across a network with no slack in it. And passengers pay in hours lost and a small but real erosion of confidence in the ordinary act of boarding a plane. One email can force a continent’s aviation system to spend millions and mobilise its military; and the sender risks almost nothing if the message cannot be traced. The more often it works, the more likely it is to be copied.

How a cheap email became a weapon against European aviation

The timing invites a geopolitical reading, and European officials have supplied one. Denmark, Poland and Romania, all affected by Thursday’s disruption, have previously accused Moscow directly of hybrid attacks, while Germany blamed Russia for an attack on Leipzig airport in August. The pattern of recent months, from sabotaged infrastructure to hacked air-raid sirens sounding fake radiation alerts over Ukraine and Russia, has taught European capitals to read disruption as a message. Russia and Iran deny any such campaign, and no country has attributed this week’s threats to either of them.

The signature on the Rome email complicates the simple version of that story. “Fighters of the Male State” reads less like a state intelligence operation than like the fringe of an online subculture; an ultra-right, anti-feminist current whose grievance is aimed at European societies themselves rather than at any government. If the sender is a domestic extremist, or a provocateur borrowing a banned group’s name, then the threats are a different kind of attack: not a state pressing a lever, but a private actor discovering that the lever exists and costs nothing to pull. The coordination is not in doubt: Air France-KLM chief Ben Smith said he had never seen threats reported in such a coordinated fashion, and Osprey Flight Solutions’ Rhys Jones called seven confirmed threats in one day exceptional.

What the disruption does to airlines, airports and passengers

For the airlines, the bill lands on top of an already thin margin. Ryanair, which had three of its aircraft escorted to the ground in Bulgaria on Thursday, is already weighing staff pay freezes as a €2 billion fuel shock threatens Europe’s cheapest fares, as Magna Bureau reported; and a week of diversions, inspections and rebookings is the kind of cost that no budget line anticipates.

For airports, the week exposes a different weakness: the inbox. The threats arrived as ordinary emails to airlines, airport operators and ground handlers, and the first line of defence is a member of staff deciding, in minutes, whether a message is a prank or a plot. For passengers, the lesson is quieter: a diversion to a military air base, two and a half hours on board, a bus to Paris and a replacement flight to Rome. Aviation security scares have forced emergency diversions before; a cockpit attack forced a FlyDubai jet to divert to Tabuk after both pilots were injured; but the industry survived Thursday by spending, at full speed, the trust that makes people board a plane without thinking twice.

When the next answers are due

The investigations will speak first, if they speak at all. Police and cybercrime units in France, the Czech Republic, Bulgaria and Spain are tracing the emails, and the first real test will be whether any of them can name a sender; or at least say whether the Monday, Tuesday and Thursday waves came from the same hands.

The second test is whether the pattern repeats. If next week brings another wave, the question will no longer be who is behind it but how long European aviation can keep paying the full price of every threat. Until then, every departure board in Europe carries a small, new uncertainty; and the next email may already be on its way.