Bomb threats hit seven European flights and a cruise ship in one day; every search came up empty

At least seven passenger flights and one cruise ship across six European countries received bomb threats on Tuesday, Nov. 3, 2026. Fighter jets escorted a Ryanair flight into Rome. An airport near Warsaw closed. About 1,500 people were taken off a cruise ship at the Greek island of Syros. By the end of the day, every search had come back empty. No device was found on any aircraft or on the ship, no one had claimed responsibility, and no government had named a suspect, AFP and Reuters reported via Al Jazeera.

The threats came a day after a Wizz Air flight from London Luton to Sofia was diverted to Budapest under fighter escort, and two days after hackers switched supermarket freezers into heating mode in at least five European countries, which 567politics covered in its report on the second refrigeration wave. Officials and analysts were quick to put the two episodes in the same frame of "hybrid" disruption. The evidence for that link, as of Tuesday night, is timing and pattern, not forensics.

What happened, country by country

The incidents below are drawn from wire reports by the Associated Press, Reuters, AFP and dpa, each of which quoted the relevant national authority or airline. Times are local.

Poland. A LOT Polish Airlines Boeing 737 MAX from London Heathrow to Warsaw Chopin, carrying 181 people, received a bomb alert on board at 9:54 a.m. and landed at Warsaw Modlin at 10:01 a.m., where specialists examined it, Reuters reported via ABC Australia. Modlin closed, then reopened. "Nothing was found," airport spokesman Adam Szablowski said, per AFP via Malay Mail. The threat was formally canceled at 12:21 p.m., dpa reported. Separately, SAS flight SK751 from Copenhagen landed at Chopin as scheduled after a threat; one runway closed during the inspection. SAS said it could "confirm that a threat has been made against flight SK751" and that the landing was "not an emergency landing." The matter was referred to Polish police.

Italy. A Ryanair flight from Lisbon landed at Rome Fiumicino at 9:40 a.m. after an email claimed a bomb was aboard; bomb-disposal officers checked passengers, crew and baggage and found nothing, AP reported via PBS. About an hour later, Ryanair flight FR9611 from Dublin was met by two Eurofighters of the Italian Air Force's 4th Wing, which took off from Grosseto on a "decollo immediato," or scramble order, after "a report of a suspected threat aboard a civilian aircraft," and escorted it to Fiumicino, where it landed at 10:45 a.m., ANSA reported. Checks were negative.

Spain. The airport operator Aena activated an emergency protocol for a Ryanair flight from Manchester to Murcia, which landed at 10:30 a.m. without incident. Francisco Lucas, the Spanish government's delegate in the Murcia region, said 121 people were on board, including crew; the Guardia Civil found no explosives, per AP and dpa.

Bulgaria. Two aircraft, a Wizz Air flight from Bergamo and a Ryanair flight from Dublin, received threats en route to Sofia. Neither was diverted. Transport Minister Georgi Peev said one threat was first reported by the pilot, who learned of it through airline channels, and that counter-terrorism officers found no explosives after landing, AP reported, citing the BTA news agency.

United Kingdom. The Metropolitan Police said it was "aware of threats made on the morning of Tuesday, November 3 against four aircraft" due to depart from or arrive at Heathrow, and "a further threat against an aircraft at Manchester Airport." "Following an assessment by the respective airlines, no security issues were identified," the force said, per dpa. Counter Terrorism Policing said it was aware of the European incidents but that there was "no active investigation by CTP into any of these matters." A government spokesperson called them "malicious hoax threats" and said "the UK has one of the most robust aviation security systems in the world." The wires did not explain how the four Heathrow aircraft relate to the LOT flight, which also departed Heathrow.

Greece. The Panama-flagged cruise ship Crown Iris, operated by the Israeli line Mano Maritime, was evacuated at Syros after port authorities were told an explosive device had been placed on the hull. The ship was carrying 940 passengers and 597 crew and was due to sail for Haifa, To Vima reported. Coast guard officers searched with an explosives-detection dog and a diver, found nothing, and called in the Hellenic Coast Guard's underwater operations unit for a second inspection, Cruise Hive reported. The ship was still in port at about 10 p.m., several hours behind its 5 p.m. departure. Local authorities had banned a planned anti-war protest on the Ermoupoli waterfront the day before, saying the location "posed a severe threat to public security," and moved it elsewhere.

Sources: AP via PBS, AFP and Reuters via Al Jazeera, dpa via Yahoo News, To Vima. The Metropolitan Police's four Heathrow aircraft are not listed separately because the wires did not identify them.

How the threats arrived

The method varied, which matters for anyone trying to tie the incidents to one sender. The Rome threat about the Lisbon flight came by email, AP reported; dpa described the Dublin-to-Rome warning as an anonymous phone call. In Bulgaria, one threat reached the pilot through the airline's own channels. Bulgarian media reported that an earlier threat against a flight to Sofia was sent by email. Hungary's Defense Minister, Romulusz Ruszin-Szendi, said Monday's Luton-to-Sofia alert was flagged by NATO's air-defense alert service, after which Hungarian Gripen jets scrambled to escort the Wizz Air plane to Budapest, AFP reported. Bulgaria's acting Interior Ministry secretary general, Lyubomir Nikolov, said on Tuesday that authorities were still trying to identify who sent that message.

1. 2026-11-02Wizz Air Luton to Sofia diverted to Budapest under Hungarian Gripen escort
2. 2026-11-039:40 a.m., Ryanair from Lisbon lands at Rome Fiumicino after email threat
3. 2026-11-039:54 a.m., LOT Heathrow to Warsaw receives alert; lands at Modlin at 10:01
4. 2026-11-0310:30 a.m., Ryanair Manchester to Murcia lands under emergency protocol
5. 2026-11-0310:45 a.m., Ryanair FR9611 from Dublin lands at Rome under Eurofighter escort
6. 2026-11-03Afternoon, two Sofia-bound flights searched; SAS SK751 inspected at Warsaw
7. 2026-11-03Afternoon and evening, Crown Iris evacuated at Syros; divers search the hull

Source: AP via PBS, Reuters via ABC Australia

Rhys Jones of the aviation advisory firm Osprey Flight Solutions told Reuters that seven confirmed threats in one day was exceptional. "The lack of clear target state, airline or route indicates that general disruption to aviation operations is the aim," he said. His colleague Matthew Borie told AP there were several possible explanations: copycats following one threat, a single person or group making repeated calls, or "hybrid warfare" by state actors or their supporters. He said such threats are "not a new phenomenon," that there "could be a Russian angle," and that Iranian hybrid activity is also active in parts of Europe. He advised travelers not to be alarmed, pointing to national response systems that include fighter escorts.

Those are analysts' hypotheses. No official in any of the six countries attributed Tuesday's threats to a state, and the one police force that addressed the question, Britain's Counter Terrorism Policing, said it was not investigating.

The context officials are reaching for

European governments have spent two years attributing a growing list of incidents to Russia and, in some cases, Iran. AP's account of Tuesday's threats placed them alongside drone incursions, the freezer attacks and unexplained triggering of public alert apps as suspected hybrid activity. Both governments deny involvement in sabotage, Reuters noted. How quickly European capitals now reach for a hostile-state frame, and how rarely they publish the evidence, was visible last week in Germany's spyware warning to Bundestag members. The supermarket freezer attacks of October and this week, in which controllers were set to 50°C, remain unattributed; France's cyber agency and Romania's cyber directorate have said the method was basic and that there is no evidence yet of a state behind it, as our refrigeration report set out. Last month a Tel Aviv-to-Vienna flight made an emergency landing in Bulgaria after a bomb threat, AP noted.

The Crown Iris sits in a different context. The ship, which was on a seven-night Greek islands cruise from Haifa, has been the target of protests at Rhodes, Crete, Kefalonia, Corfu and Piraeus in 2026, To Vima reported, and in June a 37-year-old Palestinian man was arrested in Crete over a suspected plot against it, according to Cruise Hive. Whether Tuesday's threat was connected to the flight threats, to the protests, or to neither is unknown. The ship's Israeli ownership makes it a target for reasons that have nothing to do with Ryanair's Dublin schedule, and investigators have not said the cases are linked.

The Polish incidents land during a dispute between President Karol Nawrocki and Prime Minister Donald Tusk over who runs national security, which 567politics covered in its report on the National Security Council meeting. Neither man had commented on the Modlin diversion in the reports we read. Bulgaria, which fielded three of the week's threats, voted in a presidential runoff two days earlier; 567politics reported Iliana Iotova's win.

What the responses tell us

Three different response models were on display. Italy and Hungary scrambled fighters, through NATO's integrated air-defense system, to escort civilian aircraft to the ground. Poland diverted a plane to a secondary airport and closed it. Britain let the airlines assess the threats and, finding them not credible, kept flights moving. All three ended with the same result, no device, and none of the three countries has said its approach was wrong.

The costs differ. A fighter scramble and an airport closure are visible and expensive; they also signal to whoever made the calls that a single email can move military aircraft. An airline-level assessment is cheaper and quieter; it also depends on the airline's judgment being right every time. Jones's observation that the aim appears to be "general disruption" cuts both ways. If disruption is the goal, the response itself is part of what the sender achieves. If the threat is real, the response is what saves lives. Officials in each country made that trade-off differently on Tuesday, and no one can yet say which call was correct, because no one knows who was calling.

Online reaction: what we could not verify

567politics attempted to read Reddit's r/worldnews, r/europe and r/geopolitics listings and X's trending pages during this run. Every request to Reddit was refused and X's pages could not be read. Our tool for confirming a post's exact text, author and timestamp from its permalink failed for every X post we attempted, including a post by the Israeli broadcaster ILTV about the Crown Iris that appeared in search results. We therefore quote no social media posts in this article and make no claim about public sentiment in Poland, Italy, Spain, Bulgaria, Britain or Greece. We found no representative poll on these incidents. The absence of quoted posts reflects our access, not the volume of reaction.

What remains unknown

Who sent the threats, how many senders there were, and whether any of Tuesday's incidents are connected to Monday's or to each other. The different delivery methods, email, phone and airline channels, are consistent with either a coordinated campaign or copycats; neither has been shown.

Whether the Crown Iris threat is related to the aviation threats at all.

Whether any arrests follow. Bulgaria said it was trying to identify a sender; Poland referred the SAS matter to police; Britain's counter-terrorism police said they were not investigating. No arrest had been reported in any country by late Tuesday.

Whether governments will change procedures. Seven false alarms in a day, after Monday's diversion and last month's emergency landing in Bulgaria, is a pattern airlines and air-defense commands will have to decide how to price. None had announced a change by Tuesday night.

Differing perspectives

How should European governments respond to a wave of bomb threats against flights that turn out to be false?

Each position is summarized as its supporters make it, with equal weight and in alphabetical order. A summary is not an endorsement; the evidence for each is weighed in the story above.

• Call them hoaxes, trust the airlines' assessment and keep flying

  Who holds it: The UK government and the Metropolitan Police's aviation unit

  British authorities argue that the right answer to a malicious hoax is a calm, layered assessment rather than disruption. The government spokesperson said the UK has one of the most robust aviation security systems in the world, with well-tested processes. The Metropolitan Police said that after the respective airlines assessed the threats against four Heathrow aircraft and one at Manchester, no security issues were identified, and flights continued. On this view, grounding or diverting aircraft on every anonymous message hands the sender exactly the disruption sought.

  In their words: dpa, as published by Yahoo News, quoting the UK government and Metropolitan Police ↗

• Scramble fighters and escort every threatened aircraft to the ground

  Who holds it: Hungary's Defense Ministry under Romulusz Ruszin-Szendi and the Italian Air Force

  Hungary and Italy argue that a threat against a civilian airliner in flight is a matter for air defense first and for the police afterwards. Hungary's defense minister said NATO's air-defense alert service flagged Monday's Wizz Air flight and Hungarian Gripens scrambled to escort it to Budapest. The Italian Air Force said two Eurofighters took off on an immediate scramble order after a report of a suspected threat aboard a civilian aircraft and escorted it to Rome. In this view, the cost of a scramble is small against the cost of being wrong once, and the escort also deters anyone contemplating a real attack.

  In their words: AFP, as published by Malay Mail, quoting Defense Minister Ruszin-Szendi ↗

• Treat it as crime: find the sender, not a geopolitical culprit

  Who holds it: Bulgaria's Interior Ministry under acting Secretary General Lyubomir Nikolov; UK Counter Terrorism Policing

  Police authorities in Bulgaria and Britain argue that the immediate task is identifying who sent the messages, which is ordinary criminal investigation. Nikolov said counter-terrorism units checked the aircraft and that authorities were still trying to identify the sender of Monday's threat. UK Counter Terrorism Policing said it was aware of the European incidents but had no active investigation into any of them, which places the matter with regular police and the airlines. On this reading, speculating about states before a sender is identified risks giving a hoaxer a significance the facts do not yet support.

  In their words: Associated Press, as published by PBS NewsHour, quoting Bulgarian officials ↗

• Treat it as organized disruption and investigate it as such

  Who holds it: Aviation-risk analysts at Osprey Flight Solutions, including Rhys Jones and Matthew Borie

  These analysts argue that seven confirmed threats in a single day is exceptional, and that the absence of any clear target state, airline or route points to general disruption of aviation as the aim rather than a grievance against one carrier. They say hybrid activity by states or their supporters is one plausible explanation alongside copycats or a serial hoaxer, that there could be a Russian angle and that Iranian activity is also present in parts of Europe, and that governments should pursue attribution across borders while reassuring travelers that national response systems, including fighter escorts, work.

  In their words: Al Jazeera, carrying Reuters and AFP interviews with Osprey Flight Solutions ↗