Hoax bomb threats disrupt seven flights and a cruise ship across Europe

A wave of hoax bomb threats disrupted at least seven commercial flights and an Israel-bound cruise ship across six European countries on Tuesday, grounding security teams from Warsaw to Rome and forcing one jet into an emergency diversion escorted by fighter aircraft. No explosive device was found in any case, and by Wednesday no individual or group had claimed responsibility.

The threats hit flights operated by Ryanair, Wizz Air, Scandinavian Airlines and LOT Polish Airlines, according to Reuters reporting carried by multiple outlets. Two flights bound for Warsaw were affected: a LOT service from London was diverted to the capital's secondary Modlin Airport, which closed briefly, while an SAS flight from Copenhagen landed at Chopin Airport as scheduled after a runway closure for inspection. In Italy, two Eurofighter jets escorted a Ryanair flight from Dublin into Rome's Fiumicino airport, where it landed at about 10:45 a.m. local time; a second Ryanair flight from Lisbon underwent separate anti-bomb procedures after landing. Spain's Aena airport authority activated an emergency protocol for a Ryanair flight from Manchester that landed at Murcia, and Bulgarian officials inspected a Wizz Air flight from Bergamo carrying 176 passengers and a Ryanair flight from Dublin carrying 186 passengers after both landed in Sofia. London's Metropolitan Police said it was aware of threats against four aircraft at Heathrow and a further warning concerning a Manchester Airport flight, and said no security issues were identified.

Separately, the Panama-flagged cruise ship Crown Iris, carrying roughly 1,500 passengers and crew toward Haifa, was searched by an explosives-detection dog and a diver after an anonymous caller claimed a device had been attached to its hull while the vessel was anchored off the Greek island of Syros. The Greek coast guard found nothing in an initial sweep and the ship was expected to resume its voyage once further checks were completed.

A pattern stretching back a day

Tuesday's cluster followed a similar episode on Monday, when a Wizz Air flight from London Luton to Sofia received a midair bomb threat and was diverted to Budapest. Hungarian Defence Minister Romulusz Ruszin-Szendi said the country's air-defence alert system flagged the flight and that Hungarian Gripen fighter jets escorted it to a safe landing. Seven confirmed threats to flights in a single day is unusual even by the standards of European aviation security, which regularly logs isolated hoax calls but rarely this many at once, this close together, and across so many jurisdictions.

"Seven confirmed threats to flights in one day is exceptional," said Rhys Jones, an analyst at the aviation risk intelligence firm Osprey Flight Solutions, adding that the absence of any single target suggests "general disruption to aviation operations is the aim."

No government has formally attributed Tuesday's threats, and no evidence tying them to a specific actor has been made public. But the incidents landed amid months of accusations from European governments that Russia, and to a lesser extent Iran, have been running a campaign of low-level sabotage, drone incursions and disinformation designed to unsettle European societies without crossing into open conflict. EU foreign policy chief Kaja Kallas told the European Parliament in September that such hybrid attacks had "steadily increased" since Russia's invasion of Ukraine, citing incidents including a drone shot down over Lithuania and a drone pulled from Polish waters, and argued that the attacks were deliberate rather than accidental. Moscow and Tehran have consistently denied responsibility for such campaigns. NATO's own framework for countering hybrid threats treats aviation disruption as one of several tools, alongside cyberattacks and economic pressure, that state and non-state actors can use to probe a country's resilience without triggering a conventional military response.

Hoax bomb threats against European carriers are not new, but a state link has been formally established before. In 2022, the governing council of the International Civil Aviation Organization condemned Belarus after finding that a 2021 bomb threat against a Ryanair flight over Belarusian airspace had been deliberately false and relayed to the crew on the instructions of senior government officials, forcing the plane to land in Minsk so authorities could arrest a dissident journalist aboard. That episode remains the clearest precedent for a government using a fabricated bomb threat as a tool of state policy rather than a prank.

Passengers, airlines and airports absorb the disruption

The immediate burden fell on passengers and ground crews rather than on any single government. Thousands of travellers across Poland, Italy, Spain, Bulgaria, the United Kingdom and Greece faced delays, runway closures and, in several cases, being moved off aircraft while bomb-disposal teams carried out searches. Airports at Modlin and Fiumicino each closed for a limited period before reopening once searches concluded. None of the airlines involved issued detailed public statements; Reuters said Ryanair did not immediately respond to a request for comment, and the other three carriers were similarly reticent, beyond airport officials confirming that affected aircraft had landed safely and operations had returned to normal.

The disruption arrived in the same week that unidentified hackers remotely shut down refrigeration systems in supermarkets in several European countries, an incident some security analysts have grouped with the bomb threats as part of a broader pattern of low-cost, high-visibility interference. Eric Schouten, head of the aviation security group Dyami, said the string of incidents fit a pattern of Russian state actors seeking to disturb Europe.

What happens next

National police forces, including in Poland, where the SAS matter was referred to local authorities, are treating the calls as hoaxes under investigation, but as of Wednesday none had named a suspect or said how the threats were transmitted. European aviation security officials are expected to compare notes in the coming days to establish whether the calls originated from related sources, a process that in past cases involving cross-border hoaxes has taken weeks or months to produce public findings, if any emerge at all. The Belarus case took more than a year to reach a formal conclusion at the ICAO Council.

For now, airlines and airports have reverted to standard security protocols, and flights that were diverted or delayed on Tuesday resumed normal schedules by Wednesday. But officials in Brussels and at NATO headquarters, who have spent much of 2026 cataloguing a rising tempo of drone incursions, cyberattacks and sabotage attempts blamed on Russia, are likely to fold Tuesday's episode into that broader assessment, even without a confirmed culprit. Whether that assessment produces any public attribution, as it eventually did with Belarus in 2021, remains, for now, an open question.