Bomb Threats Rock Europe’s Skies. Do We Know Who’s Behind Them?

In the first week of November 2026, dozens of passenger aircraft in Europe received bomb threats. Flights were diverted, made emergency landings or were searched on arrival, and fighters from at least five countries – Hungary, Bulgaria, Serbia, Croatia and Italy – took off to escort them. By 7 November, no search had found an explosive device. The Paris prosecutor's office is investigating whether foreign states are behind the threats, but their authors have not been identified.

Flights to Bulgaria were hit almost every day. The wave is therefore not just a problem for airlines: it ties up airports, police and quick-reaction fighters, and its aim appears to be disruption rather than an explosion.

How the wave unfolded

2 November. A Wizz Air flight from London to Sofia diverted to Budapest after a threat in flight. Hungarian Defence Minister Romulusz Ruszin-Szendi said a Hungarian Gripen, ordered up by NATO's air defence duty service, escorted the aircraft to landing. After the search, the aircraft continued to Sofia.

3 November. Two aircraft bound for Sofia – a Wizz Air flight from Bergamo and a Ryanair flight from Dublin – landed at Vasil Levski airport and were searched. According to Time magazine, at least seven flights in Europe were targeted that day.

5 November. The worst day. Agencies counted between 20 and 27 affected flights. Three Ryanair aircraft bound for Sofia – from Copenhagen, Madrid and London – received threats. Two landed in Sofia and the third in Plovdiv. Bulgarian MiG-29s from the 3rd Air Base at Graf Ignatievo took off at 10:11. The Finnair flight from Helsinki to Rome was escorted by a Croatian Rafale and then by Italian fighters. An Aer Lingus flight from Dublin to Rome was diverted to France, and a Wizz Air flight from Milan to Warsaw to Vienna. Romania's intelligence service (SRI) said a KLM aircraft bound for Tel Aviv was searched in Bucharest at the pilots' request.

6 November. Serbian fighters escorted a Wizz Air aircraft from Brussels to Sofia as far as the Bulgarian border, and Hungarian fighters escorted three aircraft, including the same flight. Bulgaria's Ministry of Transport reported threats against two flights to Sofia, from Brussels and from London; both landed safely. Prague airport reported threats against flights to and from the Czech capital, and the French government four new alerts involving aircraft over France. On the same day, emailed bomb threats also went to media outlets. The buildings of Nova TV in Bulgaria, Ireland's RTÉ and Britain's Sky News were evacuated.

7 November. The Paris prosecutor's office opened an investigation. According to the AFP news agency, it aims to identify the authors of the emails and any links they may have to foreign states.

Why every threat is treated as real

A threat against a specific aircraft in the air triggers international rules: the aircraft must land, the passengers must be taken off, and the aircraft and baggage searched, the US broadcaster CNBC explains. Airlines grade threats red, amber or green, but according to Joji Waites of the British pilots' union BALPA an aircraft in the air is never given an amber rating. Once a threat is judged credible, the captain makes the decisions. "You cannot say that 20 times before it has been a hoax so this time it is a hoax," one of the experts quoted by CNBC says.

The cost is not small. According to Philip Baum of Coventry University, a single diversion can cost an airline up to $250,000. On top of that come missed onward flights, crew duty hours and passengers' lost connections. The European Union Aviation Safety Agency (EASA) rates the immediate safety risk from individual hoaxes as low, but says the high number of diversions "places an additional strain on the system".

Fighters do not search for bombs. The Bulgarian Air Force explains that in such cases NATO's Combined Air Operations Centre orders the quick-reaction fighters to find the aircraft, identify it and escort it. The Croatian escort was ordered by the centre at Torrejón in Spain. An escort shows that the air policing system works, but it does not prove there was any danger on board. Only the search on the ground can establish that.

In Flank's assessment, this is the heart of the problem. Sending an email costs almost nothing, while every alert sets off an airline, an airport, the police, bomb disposal teams and sometimes military aircraft. The analyst Jean-Marc Rickli of the Geneva Centre for Security Policy makes the same point: the sender pays almost no price and causes major disruption.

Who is behind the threats: suspicion without proof

The threats were sent by email, and some by anonymous phone calls. Some emails were signed "fighters of the Male State" – a name matching a Russian radical movement. AFP has not confirmed any link to it, and its founder Vladislav Pozdnyakov denies involvement and says the movement has not existed since 2021. The chief secretary of Bulgaria's Interior Ministry, Lyubomir Nikolov, said that in earlier cases the senders' IP addresses were in other European countries. He said there was so far no evidence of specific terrorist intent.

Governments have avoided naming a culprit. The Irish government considers it "likely" that this is "a co-ordinated campaign of disruption". Spanish Foreign Minister José Manuel Albares called the threats "an attempt at hybrid aggression and psychological warfare". Italian Prime Minister Giorgia Meloni stressed that what is being attacked is civilian, not military, infrastructure. EU Transport Commissioner Apostolos Tzitzikostas activated the EU's aviation security information-sharing mechanisms but said it was "too early" to say whether the incidents were linked. NATO said it was monitoring the situation. Kremlin spokesman Dmitry Peskov called the allegations over parallel cyberattacks on European supermarket chains "absurd".

Experts are also cautious. Elisabeth Braw of the Atlantic Council describes the threats as conflict in "the gray zone between war and peace", to which democracies find it hard to respond. Robert Jordan of the British institute RUSI notes that Russian and Iranian groups have recruited people online for similar activity, but does not rule out a non-state actor exploiting gaps in the system.

In Flank's assessment, this much can be said for now. The alerts hit many countries, airlines and routes with no common pattern. They also spread to media outlets, and the message to them speaks of "a small part of what awaits Europe". This suggests the aim is to spread insecurity rather than to hit a particular carrier. Authorship, however, has not been established, and the idea of a state-run hybrid operation remains a hypothesis until investigations show where the threats come from.

What it means for Bulgaria

According to the authorities' reports, at least eight flights bound for Bulgaria received threats between 2 and 6 November. All landed safely, and searches after landing found no explosive devices. Bulgarian MiG-29s took off at least once, and Hungarian and Serbian fighters also escorted flights to Sofia.

Todor Ivandzhikov of the Bulgarian Aviation Industry Association called the threats "another hybrid attack on Europe" without presenting evidence. He forecast that air fares in Europe could rise by 10 to 30% next year. That is his estimate, not airline or regulator data. According to him, passengers on a diverted flight are usually not entitled to cash compensation, but the carrier must get them to their final destination.

What to watch

First, the results of the French investigation and any investigations in other countries, Bulgaria included. Only they can show who is behind the threats. Second, whether procedures change. Eric Schouten of the consultancy Dyami thinks changes will take time and will probably stay confidential so that the perpetrators cannot exploit them. Third, whether the wave continues. In Flank's assessment, a long run of false alarms carries a risk of fatigue and complacency. That is exactly why the procedures require every threat to be taken seriously.