Source: AFP / Associated Press
Italian, French and Bulgarian fighter jets scrambled on Thursday 5 November 2026 as at least 14 more European flights were hit by hoax bomb alerts, the third day of a coordinated wave of threats against commercial aviation. More than 20 hoaxes have now been reported this week across the continent, and no explosives have been found on any of the targeted aircraft.
What happened
The hoaxes have particularly targeted low cost carriers and flights to or from Bulgaria, the Czech Republic and Italy. Ryanair alone has been the victim of at least seven threats, including three planes headed for Sofia from Madrid, Copenhagen and London Stansted, all escorted by Bulgarian air force jets. A Finnair flight from Helsinki to Rome was escorted by an Italian fighter jet and checked by bomb experts, while an Aer Lingus flight from Dublin to Rome was guided by French military aircraft to the Evreux air base west of Paris, where all 151 passengers and six crew members landed safely. A Wizz Air flight from Milan to Warsaw was re routed to Vienna, and four Prague bound planes flown by Ryanair, easyJet and Sky Express received emailed threats. Three flights were diverted in all, and every aircraft landed safely.
Czech police said they perceive the credibility of the threats as low but are not underestimating the situation, while Copenhagen police said there was never any danger to passengers. Threats seen by AFP against flights sent to airports in Rome and Sofia contained misogynistic messages claiming to be from “fighters of the Male State”, though no responsibility for the whole wave has been confirmed. The origin and motives remain unknown.
Hybrid disruption, not classic cybercrime
What makes this week different is the context. The threats come amid a rise in hybrid attacks in Europe, sometimes linked by authorities to Russia or Iran, including the supermarket refrigeration hacks that spoiled food across at least eleven countries, drone incursions and sabotage incidents. France’s secretary general for defence and national security, Nicolas Roche, told parliament last month that Europe is seeing “the massing of hybrid attacks in all their diversity, sabotage, cyber, drones, espionage”. The goal of such campaigns is not necessarily destruction but disruption itself: exhausted responders, closed airspace, economic cost and public anxiety, achieved at minimal cost to the attacker using nothing more than anonymous emails.
That means European organisations should plan for it in their incident response playbooks. Anonymous threat messages, whether by email, phone or through a supplier’s systems, are now a standing operational risk, not a rare event. The organisations that weather this kind of pressure well are the ones with rehearsed threat handling procedures, clear decision criteria for suspending operations, pre established lines to law enforcement and communication plans that keep customers informed without amplifying panic.
If your incident response plan has never been tested against a wave of anonymous threats, that gap is worth closing now. Contact the team at Excello Digital for professional incident response planning and security exercises.