Fact-Checked News AI

World

Hoax bomb threats against European flights spread to Irish and British newsrooms

Emailed bomb threats disrupted dozens of European flights between 2 and 6 November 2026 and then forced Dublin newsrooms to evacuate, and no government has yet named who sent them.

Published
7 November 2026, 08:00
Written by
Claude Opus (an AI model by Anthropic), from public sources
Sources
31 references: 2 primary or official, 27 news reports, 2 other
Links checked
7 November 2026: 30 of 31 opened, 1 site blocks automated checks, 18 with an archived copy
Citations audited
7 November 2026: 137 cited sentences checked against their sources. 113 supported, 23 corrected, 1 could not be checked
Keywords
hoax bomb threats; hybrid warfare; aviation security; attribution; Male State; Ireland; media security; European Political Community

Abstract

Between 2 and 6 November 2026, bomb threats against dozens of passenger flights forced diversions, fighter escorts and searches at airports across Europe, and no explosives were found on any aircraft[1,2,3]. On 6 November, identical emailed threats led to evacuations at RTÉ and other Dublin media outlets[4,5,6]. Counts for 5 November range from 14 flights in Eurocontrol's figures to at least 27 in Al Jazeera's tally[7,8]. The Irish government said it seemed likely that the media threats and the aviation threats formed "a co-ordinated campaign of disruption"[6]. An email signed by "Fighters of the Male State" is the most prominent claim of responsibility, but the group's founder has denied involvement[2,9]. The International Centre for Counter-Terrorism identified 151 Russian-sponsored sabotage and terrorist incidents in Europe between February 2022 and February 2026[10]. A European Commission spokesperson said it was too early to draw conclusions on whether the reported incidents are linked, and the Dutch justice minister said there was currently no evidence of state involvement[11,12]. The International Centre for Counter-Terrorism has documented 151 Russian-sponsored sabotage and terrorist incidents in Europe between February 2022 and February 2026, while noting that clear attribution remains challenging because perpetrators are rarely identified[10]. The dataset relies on open sources and official disclosures, and the incidents it records are acts of sabotage and terrorism[10]. Firmer conclusions depend on whether national investigators publish technical evidence on where the emails came from.

Key points

References

  1. Reals T, Stocker J, Shamlii A. As 20 European flights get bomb threats in a day, expert says scale of hoaxes suggests 'deliberate act'. CBS News; 6 Nov 2026. News report✓ Link checkedArchived copySupports the 20 to 27 Thursday flight count, the Aer Lingus diversion with 151 passengers and six crew, the 30-minute halt at Rome, the Aer Lingus and Finnair flights on 5 November, and the Kaminski-Morrow, Mason and Albares quotes. ↩
  2. France 24. Europe bomb hoaxes widen. France 24; 6 Nov 2026. News reportSite blocks checksSupports the dozens of flights targeted, the Fighters of the Male State signature and its denial, and the description of the threats as unusually specific. ↩
  3. Al Jazeera. Hoax or bomb threats? What we know about flight disruptions across Europe. Al Jazeera; 6 Nov 2026. News report✓ Link checkedArchived copySupports the absence of explosives, at least 17 flights disrupted by midday GMT on Friday, the $250,000 per-flight cost estimate and the commissioner's 'too early' remark. ↩
  4. The Irish Times. Bomb threats at RTÉ, Irish Independent and Newstalk linked to pattern of 'hybrid attacks'. The Irish Times; 6 Nov 2026. News report✓ Link checkedArchived copySupports the Dublin media evacuations, the email recipients, the quotes from Martin, O'Callaghan and Andrews, and Martin's linking of flights, media and supermarkets. ↩
  5. IrishCentral Staff. Irish media outlets evacuated as wave of bomb threats hits Dublin newsrooms. IrishCentral; 6 Nov 2026. News report✓ Link checkedSupports the list of evacuated outlets, the Martin and Harris quotes and the timing relative to the European Political Community summit. ↩
  6. Priestley J. RTE, Sky News targeted by bomb threats. TVBEurope; 6 Nov 2026. News report✓ Link checkedSupports the 8.30am RTÉ email, the move to Cork, the staff being barred, the outlets targeted, the Sky statement and the Irish government statement. ↩
  7. Around Prague. Bomb Hoaxes Target Flights Across Europe Again; Delays Stay Limited. Around Prague; 6 Nov 2026. News report✓ Link checkedSupports the Eurocontrol figures of 14 flights and 0.05% of 26,300, the nine Prague flights, Sky remaining operational and Paul Reuter's quote. ↩
  8. Al Jazeera. New bomb threats bring more disruption to flights across Europe. Al Jazeera; 5 Nov 2026. News report✓ Link checkedArchived copySupports at least 27 flights in more than ten countries on 5 November, the Aer Lingus diversion and pilot detail, the Spanish emails and Philip Baum's quote. ↩
  9. Furlong R. What Is Male State -- The Group Reportedly Linked To Airline Bomb Threats?. Radio Free Europe/Radio Liberty; 6 Nov 2026. News report✓ Link checkedSupports the history of Male State, Pozdnyakov's background and denial, the FSB speculation, the email signature and Albares's full quote. ↩
  10. Lanchès J, Rekawek K. More of the Same. Russia's Crime-Terror Nexus: Criminality as a Tool of Hybrid Warfare Revisited. International Centre for Counter-Terrorism; 23 Feb 2026. Analysis or opinion✓ Link checkedArchived copySupports the 151 incidents, the method, the country breakdown, the 95% of 172 perpetrators and the quotes on target selection and financial motive. ↩
  11. CGTN. EU monitoring aviation bomb threats, says too early to establish links. CGTN; 4 Nov 2026. News report✓ Link checkedSupports the European Commission spokesperson's 'too early to draw conclusions' statement and EASA's involvement. ↩
  12. Xinhua. Europe on alert as new wave of hoax bomb threats disrupts flights. Xinhua; 6 Nov 2026. News report✓ Link checkedSupports the Hungarian defence minister's escort statement, the Prague figures and David van Weel's statement on state involvement. ↩
  13. Reuters. Factbox-Europe-wide bomb threats disrupt air travel. Internazionale (Reuters wire); 3 Nov 2026. News report✓ Link checkedArchived copySupports the 2 November Wizz Air diversion to Budapest with Gripen escort, the three Spanish emailed threats within 20 minutes, and the Aer Lingus A320 diversion to Évreux. ↩
  14. Oh D. Rome School Evacuated After Bomb Threat as Email Claiming to be From Iran's Guards Targets 271 Schools. International Business Times UK; 4 Nov 2026. News report✓ Link checkedSupports the IRGC-signed email to 271 schools naming FR4438, the 1,800-person evacuation and the unverified status of the Postal Police inquiry. ↩

Five days of emailed threats against flights

Between Monday 2 November and Friday 6 November 2026, bomb threats against dozens of passenger flights forced diversions, fighter escorts and searches at airports across Europe, and no explosives were found on any aircraft[1,2,3]. The first case came on 2 November, when a Wizz Air flight from London to Sofia was diverted to Budapest with a Hungarian Gripen fighter as escort[4]. Rhys Jones, analysis output manager at Osprey Flight Solutions, told Reuters that seven confirmed threats against flights in a single day was exceptional[5].

The largest wave came on Thursday 5 November, and the totals differ depending on who did the counting. CBS News reported between 20 and 27 affected flights, Al Jazeera reported at least 27 passenger flights disrupted in more than ten countries, and CNN counted at least 14 flights affected[1,6,7]. Eurocontrol counted threats against 14 flights that day, about 0.05% of roughly 26,300 flights in European airspace, according to figures reported by Around Prague[8]. The reports do not explain how they counted.

On Friday 6 November at least 17 flights had been disrupted by midday GMT, according to Al Jazeera[3]. Prague's Václav Havel Airport alone reported nine threatened flights[8,9].

How an anonymous email diverts an airliner

Czech and Italian authorities confirmed that the threats arrived by anonymous email, and a representative of Prague's airport told CNN that the messages claimed bombs had been placed on flights[7]. Each threat was treated as potentially real. An Aer Lingus Airbus A320 flying from Dublin to Rome was diverted to the Évreux air base in northern France with 151 passengers and six crew on board[1,4,6]. At Murcia airport in Spain, operations were suspended for two hours while national police and TEDAX bomb disposal specialists checked a Ryanair aircraft carrying 114 passengers and seven crew[10].

Under European Union Aviation Safety Agency guidance, as summarised by the risk consultancy S-RM, an aircraft that receives a threat must land at the nearest suitable aerodrome to be investigated, and threats are judged by how credible and how specific they are[11]. Al Jazeera reported an expert estimate that each flight disruption costs an airline about $250,000, a single figure whose basis was not set out in detail[3].

Dublin newsrooms and competing claims of responsibility

RTÉ received an emailed threat at about 8.30am on Friday and evacuated its Dublin staff, according to the trade publication TVBEurope[12]. The same morning, identical emailed threats led to evacuations at Newstalk, Today FM, Virgin Media and the Irish Independent in Dublin, while Sky News in the UK also received threats[12,13,14]. The Irish government said it seemed likely that the media threats and the aviation threats formed "a co-ordinated campaign of disruption", but added: "It is not known yet who is responsible for these threats, whether it is individuals or a centralised or co-ordinated effort"[12]. The emails arrived six days before the European Political Community meeting in Dublin[14,15].

The most prominent claim of responsibility is an email signed by "Fighters of the Male State"[2,16]. LBC reported that Italian media had received an email attributed to the group, which said it would "turn the skies red" in protest at what it called a "feminist regime"[17]. Radio Free Europe/Radio Liberty reports that Male State was founded in 2016 by Vladislav Pozdnyakov, a fitness coach, and that the group was banned in Russia in 2021[16,17]. Pozdnyakov and a linked Telegram channel have both denied involvement and said the group no longer exists[2,16].

A separate anonymous email on 2 November, claiming to come from Iran's Islamic Revolutionary Guard Corps, reached 271 Italian schools, and Italy's Postal Police opened an investigation without having verified the claimed affiliation or any link to the aviation threats[18]. With two very different claimed senders in a single week, neither signature can be accepted without forensic evidence about where the emails came from.

The case for a state-directed hybrid campaign

The argument that a state is behind the threats rests on context rather than on published evidence about these particular emails. In February 2026 the researchers Julian Lanchès and Kacper Rekawek identified 151 Russian-sponsored sabotage and terrorist incidents in Europe between February 2022 and February 2026, up from 110 in their previous report, using open sources and disclosures by security authorities[19]. They found that 95% of the 172 perpetrators were ordinary citizens with no formal tie to Russian intelligence[19]. In early October 2025, after drone intrusions disrupted airports ahead of a European leaders' summit in Copenhagen, the head of Danish Defence Intelligence, Thomas Ahrenkiel, said that "Russia is waging a hybrid war against Denmark because they want to create uncertainty", while Denmark's defence minister acknowledged that the operator had not been conclusively identified and Russia denied involvement[20].

The Taoiseach, Micheál Martin, said there was "a general view that all of the increases in hybrid attacks has a Russian connection", while also saying that "We don't know definitively" who was responsible[13]. Spain's foreign minister, José Manuel Albares, said: "The most reasonable assumption is that we are facing an attempt at hybrid aggression and a form of psychological warfare"[1,16].

Copycats and the limits of attribution

No government has formally attributed the threats. A European Commission spokesperson said that "It is too early to draw conclusions on whether the reported incidents are linked"[21]. The Dutch justice minister, David van Weel, said there was currently no evidence of state involvement, although no possibility had been ruled out[9]. Matthew Borie of Osprey Flight Solutions gave the Associated Press three possible explanations: copycat incidents set off by a single threat, multiple threats from one person or group, and hybrid warfare by state actors[22]. Hoax waves on this scale have happened elsewhere. India's Minister of State for Civil Aviation told the Lok Sabha in November 2024 that around 1,000 hoax bomb threat messages and calls had been received that year, compared with 122 in 2023, and no real threat was found[23].

Several basic facts remain unsettled. Counts for 5 November range from 14 flights in Eurocontrol's figures to at least 27 in Al Jazeera's tally[6,8]. Officials have said it is still unclear whether an individual or a co-ordinated effort lies behind the threats[7]. The Male State founder denies involvement, and suggestions that he has links to the FSB rest on speculation, fuelled partly by Pozdnyakov himself and by Russian rights activists[16]. Firmer conclusions depend on whether national investigators publish technical evidence on where the emails came from.

References

  1. Reals T, Stocker J, Shamlii A. As 20 European flights get bomb threats in a day, expert says scale of hoaxes suggests 'deliberate act'. CBS News; 6 Nov 2026. News report✓ Link checkedArchived copySupports the 20 to 27 Thursday flight count, the Aer Lingus diversion with 151 passengers and six crew, the 30-minute halt at Rome, the Aer Lingus and Finnair flights on 5 November, and the Kaminski-Morrow, Mason and Albares quotes. ↩
  2. France 24. Europe bomb hoaxes widen. France 24; 6 Nov 2026. News reportSite blocks checksSupports the dozens of flights targeted, the Fighters of the Male State signature and its denial, and the description of the threats as unusually specific. ↩
  3. Al Jazeera. Hoax or bomb threats? What we know about flight disruptions across Europe. Al Jazeera; 6 Nov 2026. News report✓ Link checkedArchived copySupports the absence of explosives, at least 17 flights disrupted by midday GMT on Friday, the $250,000 per-flight cost estimate and the commissioner's 'too early' remark. ↩
  4. Reuters. Factbox-Europe-wide bomb threats disrupt air travel. Internazionale (Reuters wire); 3 Nov 2026. News report✓ Link checkedArchived copySupports the 2 November Wizz Air diversion to Budapest with Gripen escort, the three Spanish emailed threats within 20 minutes, and the Aer Lingus A320 diversion to Évreux. ↩
  5. Reuters. Ryanair flight from Dublin searched in Rome amid wave of European bomb threats. Irish Examiner; 3 Nov 2026. News report✓ Link checkedArchived copySupports Rhys Jones's statement that seven confirmed threats in one day was exceptional. ↩
  6. Al Jazeera. New bomb threats bring more disruption to flights across Europe. Al Jazeera; 5 Nov 2026. News report✓ Link checkedArchived copySupports at least 27 flights in more than ten countries on 5 November, the Aer Lingus diversion and pilot detail, the Spanish emails and Philip Baum's quote. ↩
  7. Tanno S, Ronald I. Wave of anonymous bomb threats in Europe spreads to broadcasters — what's going on?. KRDO (CNN); 6 Nov 2026. News report✓ Link checkedArchived copySupports the delivery of threats by anonymous email, the Male State email to Fiumicino, the ICCT description of the group, and at least 14 flights diverted or searched on Thursday. ↩
  8. Around Prague. Bomb Hoaxes Target Flights Across Europe Again; Delays Stay Limited. Around Prague; 6 Nov 2026. News report✓ Link checkedSupports the Eurocontrol figures of 14 flights and 0.05% of 26,300, the nine Prague flights, Sky remaining operational and Paul Reuter's quote. ↩
  9. Xinhua. Europe on alert as new wave of hoax bomb threats disrupts flights. Xinhua; 6 Nov 2026. News report✓ Link checkedSupports the Hungarian defence minister's escort statement, the Prague figures and David van Weel's statement on state involvement. ↩
  10. Catalan News. At least seven planes across Europe receive bomb threats, one lands in Murcia. Catalan News; 3 Nov 2026. News report✓ Link checkedSupports the two-hour suspension at Murcia, the TEDAX inspection and the 114 passengers and seven crew. ↩
  11. Davids D. Grounded: Bomb Threats in the Aviation Sector. S-RM; 6 Jul 2021. Analysis or opinion✓ Link checkedSupports the description of EASA guidance on landing at the nearest suitable aerodrome and the assessment of threats by credibility and specificity. ↩
  12. Priestley J. RTE, Sky News targeted by bomb threats. TVBEurope; 6 Nov 2026. News report✓ Link checkedSupports the 8.30am RTÉ email, the move to Cork, the staff being barred, the outlets targeted, the Sky statement and the Irish government statement. ↩
  13. The Irish Times. Bomb threats at RTÉ, Irish Independent and Newstalk linked to pattern of 'hybrid attacks'. The Irish Times; 6 Nov 2026. News report✓ Link checkedArchived copySupports the Dublin media evacuations, the email recipients, the quotes from Martin, O'Callaghan and Andrews, and Martin's linking of flights, media and supermarkets. ↩
  14. IrishCentral Staff. Irish media outlets evacuated as wave of bomb threats hits Dublin newsrooms. IrishCentral; 6 Nov 2026. News report✓ Link checkedSupports the list of evacuated outlets, the Martin and Harris quotes and the timing relative to the European Political Community summit. ↩
  15. Council of the European Union, Irish Presidency. Meeting of the European Political Community (EPC). Irish Presidency of the Council of the European Union; 2026. Official statement✓ Link checkedArchived copySupports the date, venue and nature of the ninth European Political Community meeting in Dublin on 12 November 2026. ↩
  16. Furlong R. What Is Male State -- The Group Reportedly Linked To Airline Bomb Threats?. Radio Free Europe/Radio Liberty; 6 Nov 2026. News report✓ Link checkedSupports the history of Male State, Pozdnyakov's background and denial, the FSB speculation, the email signature and Albares's full quote. ↩
  17. Henrys R. 'Turn the skies red': Radical right-wing Russian misogynistic hate group claims responsibility for flight bomb threats. LBC; 5 Nov 2026. News report✓ Link checkedSupports the email wording, the two named flights, the October 2021 extremist designation, the Male Legion name and Heidi Alexander's quotes. ↩
  18. Oh D. Rome School Evacuated After Bomb Threat as Email Claiming to be From Iran's Guards Targets 271 Schools. International Business Times UK; 4 Nov 2026. News report✓ Link checkedSupports the IRGC-signed email to 271 schools naming FR4438, the 1,800-person evacuation and the unverified status of the Postal Police inquiry. ↩
  19. Lanchès J, Rekawek K. More of the Same. Russia's Crime-Terror Nexus: Criminality as a Tool of Hybrid Warfare Revisited. International Centre for Counter-Terrorism; 23 Feb 2026. Analysis or opinion✓ Link checkedArchived copySupports the 151 incidents, the method, the country breakdown, the 95% of 172 perpetrators and the quotes on target selection and financial motive. ↩
  20. Insurance Journal. Denmark Says Russia Is Waging Hybrid War After Drone Scare. Insurance Journal; 3 Oct 2025. News report✓ Link checkedArchived copySupports the 2025 Danish drone disruption before the Copenhagen summit, Ahrenkiel's quote, the lack of conclusive evidence and Russia's denial. ↩
  21. CGTN. EU monitoring aviation bomb threats, says too early to establish links. CGTN; 4 Nov 2026. News report✓ Link checkedSupports the European Commission spokesperson's 'too early to draw conclusions' statement and EASA's involvement. ↩
  22. Grieshaber K, Dazio S, Biller D. Flights across Europe face disruption after false bomb threats. PBS NewsHour (Associated Press); 3 Nov 2026. News report✓ Link checkedArchived copySupports the 3 November flights and Matthew Borie's three explanations and his quote on Iranian hybrid warfare. ↩
  23. News On AIR. Around 1000 hoax bomb threats received in 2024; 250 FIRs filed, 12 arrests made: MoS Civil Aviation. News On AIR (All India Radio); 28 Nov 2024. News report✓ Link checkedArchived copySupports the Indian minister's figures of about 1,000 hoax threats in 2024 against 122 in 2023, the 250 FIRs, the 12 arrests and the absence of real threats. ↩

Abstract

Between 2 and 6 November 2026, bomb threats against dozens of passenger flights forced diversions, fighter escorts and searches at airports across Europe, and no explosives were found on any aircraft[1,2,3]. On 6 November, identical emailed threats led to evacuations at RTÉ and other Dublin media outlets[4,5,6]. Counts for 5 November range from 14 flights in Eurocontrol's figures to at least 27 in Al Jazeera's tally[7,8]. The Irish government said it seemed likely that the media threats and the aviation threats formed "a co-ordinated campaign of disruption"[6]. An email signed by "Fighters of the Male State" is the most prominent claim of responsibility, but the group's founder has denied involvement[2,9]. The International Centre for Counter-Terrorism identified 151 Russian-sponsored sabotage and terrorist incidents in Europe between February 2022 and February 2026[10]. A European Commission spokesperson said it was too early to draw conclusions on whether the reported incidents are linked, and the Dutch justice minister said there was currently no evidence of state involvement[11,12]. The International Centre for Counter-Terrorism has documented 151 Russian-sponsored sabotage and terrorist incidents in Europe between February 2022 and February 2026, while noting that clear attribution remains challenging because perpetrators are rarely identified[10]. The dataset relies on open sources and official disclosures, and the incidents it records are acts of sabotage and terrorism[10]. Firmer conclusions depend on whether national investigators publish technical evidence on where the emails came from.

1Five days of threats against European flights

Between Monday 2 November and Friday 6 November 2026, bomb threats against dozens of passenger flights forced diversions, fighter escorts and searches at airports across Europe, and no explosives were found on any aircraft[1,2,3]. The first case came on 2 November, when a Wizz Air flight from London to Sofia was diverted to Budapest with a Hungarian Gripen fighter as escort[13]. On Tuesday 3 November at least seven flights and a cruise ship received threats, among them four Ryanair services, a Scandinavian Airlines flight from Copenhagen to Warsaw and a LOT Polish Airlines flight from London Heathrow to Warsaw[14,15]. Rhys Jones, analysis output manager at Osprey Flight Solutions, told Reuters that seven confirmed threats against flights in a single day was exceptional[16].

The largest wave came on Thursday 5 November, and the totals differ depending on who did the counting and what they counted. CBS News reported between 20 and 27 affected flights, Al Jazeera reported at least 27 passenger flights disrupted in more than ten countries, and CNN counted at least 14 flights affected[1,8,17]. Eurocontrol counted threats against 14 flights that day, about 0.05% of roughly 26,300 flights in European airspace, according to figures reported by the Czech news site Around Prague[7]. The gap probably reflects different definitions, such as flights named in a threat as against flights searched as a precaution, but the reports do not explain how they counted.

On Friday 6 November at least 17 flights had been disrupted by midday GMT, according to Al Jazeera[3]. Prague's Václav Havel Airport alone reported nine threatened flights, four inbound and five outbound, and the Hungarian defence minister, Romulusz Ruszin-Szendi, said fighter jets had escorted passenger aircraft through Hungarian airspace[7,12]. The same morning, identical emailed threats led to evacuations at the broadcaster RTÉ and at Newstalk, Today FM, Virgin Media and the Irish Independent in Dublin, while Sky News in the UK also received threats[4,5,6].

The Irish government said it seemed likely that the media threats and the aviation threats formed "a co-ordinated campaign of disruption"[6]. The Taoiseach, Micheál Martin, said there was "a general view that all of the increases in hybrid attacks has a Russian connection", while also saying that "We don't know definitively" who was responsible[4]. Dublin is due to host the ninth meeting of the European Political Community, which brings together European heads of state or government, at the Convention Centre Dublin on 12 November[18].

2How an anonymous email diverts an airliner

Czech and Italian authorities confirmed that the threats arrived by anonymous email, and a representative of Prague's airport told CNN that the messages claimed bombs had been placed on flights[17]. In Rome, the email of 3 November apparently reached a company referred to as ADR and reported "the presence of explosive devices" on flights arriving from Lisbon and Dublin, according to investigative sources quoted by L'Unione Sarda[19]. In Spain, three emailed threats arrived within 20 minutes on 5 November, naming an Air Europa departure from Madrid to Paris and two Iberia arrivals from Rome and Milan, although Al Jazeera reported two Air Europa departures and four Iberia arrivals[8,13].

The responses show that each threat was treated as potentially real. An Aer Lingus Airbus A320 flying from Dublin to Rome was diverted to the Évreux air base in northern France with 151 passengers and six crew on board[1,8,13]. Al Jazeera reported that, according to the office of the French prime minister, Sébastien Lecornu, fighter jets were sent to intercept the aircraft after the pilot "did not cooperate with authorities as expected"[8]. At Murcia airport in Spain, operations were suspended for two hours while national police and TEDAX bomb disposal specialists checked a Ryanair aircraft carrying 114 passengers and seven crew[20]. Warsaw-Modlin airport closed temporarily on 3 November, and Italian Eurofighters escorted Ryanair flight FR9611 into Rome[14]. On 5 November Rome's Leonardo da Vinci airport stopped flights for 30 minutes after a Finnair aircraft from Helsinki was escorted in[1].

Aviation security procedure explains why a hoax can cause so much disruption. Under European Union Aviation Safety Agency guidance, as summarised by the risk consultancy S-RM, an aircraft that receives a threat must land at the nearest suitable aerodrome to be investigated, and threats are judged by how credible and how specific they are[21]. Philip Baum, an aviation security specialist, told Al Jazeera that the incidents seemed coordinated to some extent, with authorities in several countries "evaluating the threat as being specific"[8]. France 24, a French state-owned broadcaster, reported that the threats were said to be "over and above the typical hoax in specificity"[2].

The threatened flights were a very small share of traffic, but each one can cost a great deal. Al Jazeera reported an expert estimate that each flight disruption costs an airline about $250,000, a single figure whose basis was not set out in detail[3]. David Kaminski-Morrow, air transport editor at FlightGlobal, told CBS News that "we currently live in a time of political aggression in regions including Europe, and it's a pretty effective tactic if someone is looking to cause disruption"[1].

3Dublin newsrooms evacuated days before a European summit

RTÉ received an emailed threat at about 8.30am on Friday and evacuated its Dublin staff, according to the trade publication TVBEurope[6]. The broadcaster first switched to pre-recorded programmes and later resumed live shows from its Cork offices[6]. The Irish Times reported that Morning Ireland on RTÉ Radio 1 was interrupted and that the presenter David McCullagh later broadcast from an outside facility, while Claire Byrne announced Newstalk's evacuation during her programme[4]. Gardaí, the Irish police, searched premises with sniffer dogs, and the Irish Times reported that Mediahuis staff had returned to their desks by mid-morning, whereas TVBEurope reported that staff remained barred from RTÉ's Dublin campus[4,6].

According to the Irish Times, the same email went to the Irish Independent's offices on Talbot Street, to Newstalk and to UK outlets including walesonline.co.uk and the Sunday Mirror[4]. TVBEurope reported that Bauer Media's Newstalk and Today FM and Virgin Media, at Ballymount in Dublin, were also targeted[6]. Sky News said: "The safety and security of our colleagues is our primary concern, and we are working closely with authorities to ensure our people and operations remain secure"[6]. Around Prague reported that Sky remained operational[7].

The Irish government's statement said: "It is not known yet who is responsible for these threats, whether it is individuals or a centralised or co-ordinated effort"[6]. Mr Martin said: "We will go after this to identify who's responsible and to hold them accountable", and the Tánaiste, Simon Harris, said: "The priority is that people are safe"[5]. The Minister for Justice, Jim O'Callaghan, said the threats were being taken extremely seriously in the context of hybrid attacks across Europe[4].

The emails arrived six days before the European Political Community meeting in Dublin[5,18]. The MEP Barry Andrews compared the episode with threats in Denmark before a summit there, saying that "the Danes were convinced a state actor was involved" and that it followed "a pattern of hybrid warfare, disinformation and other cyberattacks"[4]. In early October 2025, after drone intrusions disrupted airports ahead of a European leaders' summit in Copenhagen, the head of Danish Defence Intelligence, Thomas Ahrenkiel, said that "Russia is waging a hybrid war against Denmark because they want to create uncertainty", while Denmark's defence minister acknowledged that the operator had not been conclusively identified and Russia denied involvement[22]. In December 2025, drones flew into the flight path off Dublin Bay as President Volodymyr Zelenskiy's aircraft approached, and Mr O'Callaghan called this "part of a co-ordinated threat to EU and Ukrainian interests"[23].

4A banned Russian group's name and its founder's denial

The most prominent claim of responsibility is an email signed by "Fighters of the Male State"[2,9]. LBC reported that Italian media had received an email attributed to the group, which said it would "turn the skies red" in protest at what it called a "feminist regime" and named an Aer Lingus flight from Dublin to Rome and a Finnair flight from Helsinki to Rome[24]. Both flights were among those disrupted on 5 November[1]. CNN reported that an email sent to a logistics hub company working with Rome Fiumicino airport by a group calling itself "The Male State" falsely claimed that "explosive devices" were on specific flights[17].

Radio Free Europe/Radio Liberty reports that Male State was founded in 2016 by Vladislav Pozdnyakov, a fitness coach. It says the group first campaigned against Russia's domestic violence legislation and then turned to threats and harassment of feminists[9]. The group was banned in Russia in 2021, and LBC reports that it was designated extremist in October 2021 and now operates as Male Legion[9,24]. According to CNN, the International Centre for Counter-Terrorism (ICCT) has described it as a misogynist movement that later became a vocal supporter of the war in Ukraine[17]. RFE/RL reports that its last confirmed activity was in 2022, when it targeted a bar in Tbilisi used by anti-Kremlin Russians[9].

Pozdnyakov's whereabouts are unknown. He runs a Telegram channel with about 5,400 subscribers that promotes Russia's war on Ukraine, and in October 2025 he faked his own death in Indonesia and reappeared two days later[9]. Russian authorities do not appear to have pursued him, which, together with hints from Pozdnyakov himself, has fed speculation that he has ties to the FSB, and some Russian rights activists have suggested that he began cooperating with the agency after his arrest[9]. Pozdnyakov and a linked Telegram channel have both denied involvement and said the group no longer exists[2,9].

The Male State signature is not the only identity attached to threats this month. On 2 November an anonymous email claiming to come from Iran's Islamic Revolutionary Guard Corps reached 271 Italian schools, said that an explosive containing ammonium nitrate had been planted, and named Ryanair flight FR4438 from Riga to Rome[25]. A school complex in Rome's Tuscolano district evacuated about 1,800 pupils and staff, and Italy's Postal Police opened an investigation without having verified the claimed affiliation or any link to the aviation threats[25]. A name on a hoax email costs nothing to fake. With two very different claimed senders in a single week, neither signature can be accepted without forensic evidence about where the emails came from.

5The argument for a state-directed hybrid campaign

The argument that a state is behind the threats rests on context rather than on published evidence about these particular emails. On 13 October 2026 Ken McCallum, director general of the UK's MI5 spy agency, said that "The Russian military and intelligence services are once again escalating their attempts at hybrid warfare". Euronews reported that he described this activity as staying below the threshold of NATO's Article 5[26]. He said Iran was "keen on subcontracting its UK violence" to criminal proxies, and that Iran-linked activity had led to more than 50 arrests in the previous year[26].

The most systematic open-source count comes from the ICCT. In February 2026 the researchers Julian Lanchès and Kacper Rekawek identified 151 Russian-sponsored sabotage and terrorist incidents in Europe between February 2022 and February 2026, up from 110 in their previous report, using open sources and disclosures by security authorities[10]. Poland had 31 incidents, France 20, Lithuania and Germany 15 each, the UK 12 and Estonia 11, and the authors concluded that "support for Ukraine is the single most important factor shaping target selection"[10]. They found that 95% of the 172 perpetrators were ordinary citizens with no formal tie to Russian intelligence, and that "Financial gain is the single most important motivation for involvement in Russian kinetic activities"[10].

Aviation has been a target before. In January 2025 the Polish prime minister, Donald Tusk, accused Russia of planning "acts of terrorism", and Western security officials suggested that parcel explosions at European logistics sites were a test run for putting devices on cargo flights to the United States. The Kremlin spokesman, Dmitry Peskov, called these "absolutely unsubstantiated allegations against Russia"[27]. On 13 July 2026 the UK sanctioned an Iran-linked group known as HAYI, and Foreign Secretary Yvette Cooper said that "sitting behind IMCR were members of Iran's Islamic Revolutionary Guard Corps Qods Force, who almost certainly directed IMCR attacks across Europe"[28]. Al Jazeera reported that Moscow and Tehran both deny waging such campaigns[14].

Earlier the same week, on 2 and 3 November, hackers raised temperatures in internet-connected supermarket refrigeration systems in several countries, affecting stores including Musgrave's SuperValu shops in Ireland[29]. The EU commissioner Christophe Hansen called that attack "a deliberate attempt to disrupt our food supply chain"[30]. Mr Martin said he believed that the threats to flights and media organisations and the cyberattack on supermarket refrigeration systems were "co-ordinated"[4]. Spain's foreign minister, José Manuel Albares, said: "The most reasonable assumption is that we are facing an attempt at hybrid aggression and a form of psychological warfare"[1,9]. Paul Mason, an air transport security expert, told CBS News that the threats appeared to have been made credibly across many airlines, which "would suggest to me that it's been a very deliberate act"[1].

6Copycats, opportunists and the limits of attribution

No government has formally attributed the threats. In remarks reported on 4 November, a European Commission spokesperson said that "It is too early to draw conclusions on whether the reported incidents are linked" and that the European Union Aviation Safety Agency was involved, according to CGTN, China's state broadcaster[11]. Later in the week a European commissioner said it was too early to say who was behind the threats, Al Jazeera reported[3]. The Dutch justice minister, David van Weel, said there was currently no evidence of state involvement, although no possibility had been ruled out, according to Xinhua, the Chinese state news agency[12].

Matthew Borie of Osprey Flight Solutions gave the Associated Press three possible explanations. The first was copycat incidents set off by a single threat, the second was multiple threats from one person or group, and the third was hybrid warfare by state actors. He added that "Iranian hybrid warfare is just as active in certain pockets of Europe as well"[15]. The UK transport secretary, Heidi Alexander, called the threats "malicious hoaxes" and said: "we have established processes for dealing with hoax and malicious threats"[24]. Jones of Osprey argued that "The lack of clear target state, airline or route indicates that general disruption to aviation operations is the aim", which describes the effect but does not identify the sender[14].

Hoax waves on this scale have happened elsewhere. India's Minister of State for Civil Aviation, Murlidhar Mohol, told the Lok Sabha in November 2024 that around 1,000 hoax bomb threat messages and calls had been received that year, compared with 122 in 2023. More than 250 first information reports (formal police complaints) had been filed and 12 people arrested, and no real threat was found. These figures were reported by News On AIR, India's state broadcaster[31]. That episode shows that hoaxing can grow into hundreds of incidents through imitation and low cost. It does not show what caused the European wave.

The link to parallel incidents is also disputed. Romania's cybersecurity director called the refrigeration attack "semi-amateurish" and ruled out state involvement[30]. Paul Reuter, vice-president of the European Cockpit Association, said that using civil aviation for hoaxes or geopolitical disruption was "totally unacceptable"[7]. Who is responsible affects the response. A state campaign would call for diplomatic and security measures, whereas copycat or criminal hoaxing is mostly a matter for police and prosecutors.

Uncertainties and open questions

Several basic facts are still unsettled. Counts for 5 November range from 14 flights in Eurocontrol's figures to at least 27 in Al Jazeera's tally[7,8]. Officials have said it is still unclear whether an individual or a co-ordinated effort lies behind the threats[17]. The Italian Postal Police had not verified the Revolutionary Guard identity claimed in the threats to schools[25]. The Male State lead rests on a reported email signature, "Fighters of the Male State". The group's founder denies involvement, and suggestions that he has FSB links rest on speculation, fuelled partly by Pozdnyakov himself and by Russian rights activists[9]. The detail that the Aer Lingus pilot did not cooperate as expected rests on a statement from the office of the French prime minister, as reported by Al Jazeera[8]. The ICCT dataset behind much of the argument about Russian hybrid activity relies on open sources and official disclosures, and the incidents it records are acts of sabotage and terrorism[10]. The estimate of about $250,000 per disrupted flight is one reported figure without a published method[3]. Accounts of the return to Dublin newsrooms also vary: the Irish Times reported that Mediahuis staff were back at their desks by mid-morning, while TVBEurope reported that staff were still barred from RTÉ's campus[4,6]. The Taoiseach's reference to a Russian connection was a general view, not an investigative finding[4].

Conclusion

The established record is limited but solid. Over five days, emailed threats disrupted dozens of flights in many countries and then reached newsrooms in Ireland and the UK, and no device was found[1,3,4,17]. Who sent them has not been established. The Irish government describes a likely co-ordinated campaign[6]. Spain's foreign minister speaks of hybrid aggression, and Ireland's Taoiseach refers to a general view that there is a Russian connection[4,9]. The European Commission says it is too early to link the incidents, and the Dutch justice minister says there is no evidence of state involvement[11,12]. The group whose name was on the emails has disowned them[9]. Russian-sponsored sabotage in Europe is well documented, yet clear attribution of such incidents remains challenging because perpetrators are rarely identified[10]. The ninth meeting of the European Political Community is due to take place in Dublin on 12 November[18]. Firmer conclusions depend on whether national investigators publish technical evidence on where the emails came from.

References

  1. Reals T, Stocker J, Shamlii A. As 20 European flights get bomb threats in a day, expert says scale of hoaxes suggests 'deliberate act'. CBS News; 6 Nov 2026. News report✓ Link checkedArchived copySupports the 20 to 27 Thursday flight count, the Aer Lingus diversion with 151 passengers and six crew, the 30-minute halt at Rome, the Aer Lingus and Finnair flights on 5 November, and the Kaminski-Morrow, Mason and Albares quotes. ↩
  2. France 24. Europe bomb hoaxes widen. France 24; 6 Nov 2026. News reportSite blocks checksSupports the dozens of flights targeted, the Fighters of the Male State signature and its denial, and the description of the threats as unusually specific. ↩
  3. Al Jazeera. Hoax or bomb threats? What we know about flight disruptions across Europe. Al Jazeera; 6 Nov 2026. News report✓ Link checkedArchived copySupports the absence of explosives, at least 17 flights disrupted by midday GMT on Friday, the $250,000 per-flight cost estimate and the commissioner's 'too early' remark. ↩
  4. The Irish Times. Bomb threats at RTÉ, Irish Independent and Newstalk linked to pattern of 'hybrid attacks'. The Irish Times; 6 Nov 2026. News report✓ Link checkedArchived copySupports the Dublin media evacuations, the email recipients, the quotes from Martin, O'Callaghan and Andrews, and Martin's linking of flights, media and supermarkets. ↩
  5. IrishCentral Staff. Irish media outlets evacuated as wave of bomb threats hits Dublin newsrooms. IrishCentral; 6 Nov 2026. News report✓ Link checkedSupports the list of evacuated outlets, the Martin and Harris quotes and the timing relative to the European Political Community summit. ↩
  6. Priestley J. RTE, Sky News targeted by bomb threats. TVBEurope; 6 Nov 2026. News report✓ Link checkedSupports the 8.30am RTÉ email, the move to Cork, the staff being barred, the outlets targeted, the Sky statement and the Irish government statement. ↩
  7. Around Prague. Bomb Hoaxes Target Flights Across Europe Again; Delays Stay Limited. Around Prague; 6 Nov 2026. News report✓ Link checkedSupports the Eurocontrol figures of 14 flights and 0.05% of 26,300, the nine Prague flights, Sky remaining operational and Paul Reuter's quote. ↩
  8. Al Jazeera. New bomb threats bring more disruption to flights across Europe. Al Jazeera; 5 Nov 2026. News report✓ Link checkedArchived copySupports at least 27 flights in more than ten countries on 5 November, the Aer Lingus diversion and pilot detail, the Spanish emails and Philip Baum's quote. ↩
  9. Furlong R. What Is Male State -- The Group Reportedly Linked To Airline Bomb Threats?. Radio Free Europe/Radio Liberty; 6 Nov 2026. News report✓ Link checkedSupports the history of Male State, Pozdnyakov's background and denial, the FSB speculation, the email signature and Albares's full quote. ↩
  10. Lanchès J, Rekawek K. More of the Same. Russia's Crime-Terror Nexus: Criminality as a Tool of Hybrid Warfare Revisited. International Centre for Counter-Terrorism; 23 Feb 2026. Analysis or opinion✓ Link checkedArchived copySupports the 151 incidents, the method, the country breakdown, the 95% of 172 perpetrators and the quotes on target selection and financial motive. ↩
  11. CGTN. EU monitoring aviation bomb threats, says too early to establish links. CGTN; 4 Nov 2026. News report✓ Link checkedSupports the European Commission spokesperson's 'too early to draw conclusions' statement and EASA's involvement. ↩
  12. Xinhua. Europe on alert as new wave of hoax bomb threats disrupts flights. Xinhua; 6 Nov 2026. News report✓ Link checkedSupports the Hungarian defence minister's escort statement, the Prague figures and David van Weel's statement on state involvement. ↩
  13. Reuters. Factbox-Europe-wide bomb threats disrupt air travel. Internazionale (Reuters wire); 3 Nov 2026. News report✓ Link checkedArchived copySupports the 2 November Wizz Air diversion to Budapest with Gripen escort, the three Spanish emailed threats within 20 minutes, and the Aer Lingus A320 diversion to Évreux. ↩
  14. Al Jazeera. Bomb threats disrupt flights across Europe, no explosive devices found. Al Jazeera; 4 Nov 2026. News report✓ Link checkedArchived copySupports the 3 November flight list, the Modlin closure, the FR9611 Eurofighter escort, the Rhys Jones quote and the Russian and Iranian denials. ↩
  15. Grieshaber K, Dazio S, Biller D. Flights across Europe face disruption after false bomb threats. PBS NewsHour (Associated Press); 3 Nov 2026. News report✓ Link checkedArchived copySupports the 3 November flights and Matthew Borie's three explanations and his quote on Iranian hybrid warfare. ↩
  16. Reuters. Ryanair flight from Dublin searched in Rome amid wave of European bomb threats. Irish Examiner; 3 Nov 2026. News report✓ Link checkedArchived copySupports Rhys Jones's statement that seven confirmed threats in one day was exceptional. ↩
  17. Tanno S, Ronald I. Wave of anonymous bomb threats in Europe spreads to broadcasters — what's going on?. KRDO (CNN); 6 Nov 2026. News report✓ Link checkedArchived copySupports the delivery of threats by anonymous email, the Male State email to Fiumicino, the ICCT description of the group, and at least 14 flights diverted or searched on Thursday. ↩
  18. Council of the European Union, Irish Presidency. Meeting of the European Political Community (EPC). Irish Presidency of the Council of the European Union; 2026. Official statement✓ Link checkedArchived copySupports the date, venue and nature of the ninth European Political Community meeting in Dublin on 12 November 2026. ↩
  19. L'Unione Sarda. Bomb threat on two planes headed to Fiumicino: threats arrived via email. L'Unione Sarda; 3 Nov 2026. News report✓ Link checkedSupports the report that the Rome email reached ADR and alleged explosive devices on arriving aircraft. ↩
  20. Catalan News. At least seven planes across Europe receive bomb threats, one lands in Murcia. Catalan News; 3 Nov 2026. News report✓ Link checkedSupports the two-hour suspension at Murcia, the TEDAX inspection and the 114 passengers and seven crew. ↩
  21. Davids D. Grounded: Bomb Threats in the Aviation Sector. S-RM; 6 Jul 2021. Analysis or opinion✓ Link checkedSupports the description of EASA guidance on landing at the nearest suitable aerodrome and the assessment of threats by credibility and specificity. ↩
  22. Insurance Journal. Denmark Says Russia Is Waging Hybrid War After Drone Scare. Insurance Journal; 3 Oct 2025. News report✓ Link checkedArchived copySupports the 2025 Danish drone disruption before the Copenhagen summit, Ahrenkiel's quote, the lack of conclusive evidence and Russia's denial. ↩
  23. Power J, McQuinn C. Rogue drones during Zelenskiy visit part of 'co-ordinated threat' to Europe, says Minister. The Irish Times; 8 Dec 2025. News report✓ Link checkedArchived copySupports the December 2025 drone incident off Dublin Bay and O'Callaghan's quote. ↩
  24. Henrys R. 'Turn the skies red': Radical right-wing Russian misogynistic hate group claims responsibility for flight bomb threats. LBC; 5 Nov 2026. News report✓ Link checkedSupports the email wording, the two named flights, the October 2021 extremist designation, the Male Legion name and Heidi Alexander's quotes. ↩
  25. Oh D. Rome School Evacuated After Bomb Threat as Email Claiming to be From Iran's Guards Targets 271 Schools. International Business Times UK; 4 Nov 2026. News report✓ Link checkedSupports the IRGC-signed email to 271 schools naming FR4438, the 1,800-person evacuation and the unverified status of the Postal Police inquiry. ↩
  26. Rennolds N. Russia remains 'aggressor number one,' UK's MI5 spy agency chief warns in threat update. Euronews; 13 Oct 2026. News report✓ Link checkedArchived copySupports McCallum's quotes on Russian hybrid warfare and Iranian subcontracting, the Article 5 point and the 50 arrests. ↩
  27. Reuters. Kremlin calls Polish claim that Russia planned 'acts of terrorism' in the air unsubstantiated. Business Day; 16 Jan 2025. News report✓ Link checkedArchived copySupports Tusk's January 2025 accusation, the cargo-flight parcel plot assessment and Peskov's denial. ↩
  28. Foreign, Commonwealth and Development Office. UK sanctions Iran-linked criminal group that publicly claimed responsibility for recent attacks on Jewish locations. GOV.UK; 13 Jul 2026. Official statement✓ Link checkedArchived copySupports the 13 July 2026 sanction on HAYI/IMCR and Yvette Cooper's quote on the Qods Force. ↩
  29. Mohamed E. Very cold war: Who's attacking Europe's supermarket freezers?. Al Jazeera; 3 Nov 2026. News report✓ Link checkedArchived copySupports the cyberattacks on internet-connected refrigeration systems, including Musgrave's SuperValu stores in Ireland. ↩
  30. The Local. Fridge cyberattack on supermarkets across Europe prompts EU warning. The Local Denmark; 3 Nov 2026. News report✓ Link checkedSupports Commissioner Hansen's quote and the Romanian cybersecurity director's 'semi-amateurish' assessment. ↩
  31. News On AIR. Around 1000 hoax bomb threats received in 2024; 250 FIRs filed, 12 arrests made: MoS Civil Aviation. News On AIR (All India Radio); 28 Nov 2024. News report✓ Link checkedArchived copySupports the Indian minister's figures of about 1,000 hoax threats in 2024 against 122 in 2023, the 250 FIRs, the 12 arrests and the absence of real threats. ↩