{"version":"1.9","identifier":"f6695dd7-c5e0-452f-b06c-c57da6a7c894","language":"en-US","title":"Bomb threats hit seven European flights and a cruise ship in one day; every search came up empty","layout":{"columns":7,"width":1024,"margin":32,"gutter":20},"componentLayouts":{"text":{"columnStart":0,"columnSpan":7,"maximumContentWidth":720,"margin":{"top":12,"bottom":12}},"photo":{"columnStart":0,"columnSpan":7,"margin":{"top":20,"bottom":20}}},"componentTextStyles":{"default":{"fontName":"HelveticaNeue","fontSize":18,"lineHeight":29,"textColor":"#171717"},"headline":{"fontName":"HelveticaNeue-Bold","fontSize":36,"lineHeight":42,"conditional":[{"conditions":{"maxViewportWidth":480},"fontSize":28,"lineHeight":34}]},"intro":{"fontName":"HelveticaNeue","fontSize":20,"lineHeight":28,"textColor":"#555555"},"caption":{"fontName":"HelveticaNeue","fontSize":13,"lineHeight":19,"textColor":"#666666"},"byline":{"fontName":"HelveticaNeue","fontSize":13,"lineHeight":20,"textColor":"#666666"},"body":{"fontName":"HelveticaNeue","fontSize":18,"lineHeight":29,"paragraphSpacingAfter":14,"linkStyle":{"textColor":"#00704a"}}},"metadata":{"canonicalURL":"https://567politics.com/news/europe-bomb-threats-seven-flights-crown-iris-cruise-ship-no-devices-november-2026","datePublished":"2026-11-04T05:52:10.293779Z","dateModified":"2026-11-04T05:55:54.095946Z","authors":["Patrick Karsh"],"excerpt":"Fighters escorted a Ryanair jet into Rome, Warsaw Modlin closed and 1,537 people left the Crown Iris at Syros on Nov. 3. No device was found, no one claimed the threats and no state was named. Analysts see a pattern; police in Britain see hoaxes.","thumbnailURL":"https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/f6695dd7-c5e0-452f-b06c-c57da6a7c894/0b13db430505a94afecf82b1160fc1bd.jpg","keywords":["world"],"generatorName":"Frog News","generatorVersion":"1.0"},"components":[{"role":"title","text":"Bomb threats hit seven European flights and a cruise ship in one day; every search came up empty","textStyle":"headline","layout":"text"},{"role":"intro","text":"Fighters escorted a Ryanair jet into Rome, Warsaw Modlin closed and 1,537 people left the Crown Iris at Syros on Nov. 3. No device was found, no one claimed the threats and no state was named. Analysts see a pattern; police in Britain see hoaxes.","textStyle":"intro","layout":"text"},{"role":"byline","text":"By Patrick Karsh · Published November 4, 2026","textStyle":"byline","layout":"text"},{"role":"photo","URL":"https://pub-fac99da959e344fe99d810d309cef7df.r2.dev/photos/article/f6695dd7-c5e0-452f-b06c-c57da6a7c894/0b13db430505a94afecf82b1160fc1bd.jpg","caption":"A Ryanair Boeing 737-800, registration EI-ENJ, photographed in November 2016. Representative photo; four Ryanair flights received bomb threats on Nov. 3, 2026. Photo: Anna Zvereva, CC BY-SA 2.0. · Anna Zvereva via Flickr, CC BY-SA 2.0 (https://creativecommons.org/licenses/by-sa/2.0/)","accessibilityCaption":"A Ryanair Boeing 737-800, registration EI-ENJ, photographed in November 2016. Representative photo; four Ryanair flights received bomb threats on Nov. 3, 2026. Photo: Anna Zvereva, CC BY-SA 2.0.","layout":"photo"},{"role":"caption","text":"A Ryanair Boeing 737-800, registration EI-ENJ, photographed in November 2016. Representative photo; four Ryanair flights received bomb threats on Nov. 3, 2026. Photo: Anna Zvereva, CC BY-SA 2.0. · Anna Zvereva via Flickr, CC BY-SA 2.0 (https://creativecommons.org/licenses/by-sa/2.0/)","textStyle":"caption","layout":"text"},{"role":"body","format":"markdown","text":"At least seven passenger flights and one cruise ship across six European countries received bomb threats on Tuesday, Nov. 3, 2026. Fighter jets escorted a Ryanair flight into Rome. An airport near Warsaw closed. About 1,500 people were taken off a cruise ship at the Greek island of Syros. By the end of the day, every search had come back empty. No device was found on any aircraft or on the ship, no one had claimed responsibility, and no government had named a suspect, [AFP and Reuters reported via Al Jazeera](https://www.aljazeera.com/news/2026/11/4/bomb-threats-disrupt-flights-across-europe-no-explosive-devices-found).","textStyle":"body","layout":"text"},{"role":"body","format":"markdown","text":"The threats came a day after a Wizz Air flight from London Luton to Sofia was diverted to Budapest under fighter escort, and two days after hackers switched supermarket freezers into heating mode in at least five European countries, which 567politics covered in [its report on the second refrigeration wave](https://567politics.com/news/europe-supermarket-refrigeration-cyberattacks-second-wave-november-2026). Officials and analysts were quick to put the two episodes in the same frame of \"hybrid\" disruption. The evidence for that link, as of Tuesday night, is timing and pattern, not forensics.\n\n## What happened, country by country\n\nThe incidents below are drawn from wire reports by the Associated Press, Reuters, AFP and dpa, each of which quoted the relevant national authority or airline. Times are local.\n\n**Poland.** A LOT Polish Airlines Boeing 737 MAX from London Heathrow to Warsaw Chopin, carrying 181 people, received a bomb alert on board at 9:54 a.m. and landed at Warsaw Modlin at 10:01 a.m., where specialists examined it, [Reuters reported via ABC Australia](https://www.abc.net.au/news/2026-11-03/warsaw-airport-closed-after-unplanned-landing-of-london-plane/107343338). Modlin closed, then reopened. \"Nothing was found,\" airport spokesman Adam Szablowski said, [per AFP via Malay Mail](https://www.malaymail.com/news/world/2026/11/04/bomb-threats-target-10-european-flights-in-hours-forcing-airport-closures-and-fighter-jets-to-scramble/241874). The threat was formally canceled at 12:21 p.m., [dpa reported](https://www.yahoo.com/news/world/articles/two-planes-travelling-uk-europe-004833363.html). Separately, SAS flight SK751 from Copenhagen landed at Chopin as scheduled after a threat; one runway closed during the inspection. SAS said it could \"confirm that a threat has been made against flight SK751\" and that the landing was \"not an emergency landing.\" The matter was referred to Polish police.\n\n**Italy.** A Ryanair flight from Lisbon landed at Rome Fiumicino at 9:40 a.m. after an email claimed a bomb was aboard; bomb-disposal officers checked passengers, crew and baggage and found nothing, [AP reported via PBS](https://www.pbs.org/newshour/world/flights-across-europe-face-disruption-after-false-bomb-threats). About an hour later, Ryanair flight FR9611 from Dublin was met by two Eurofighters of the Italian Air Force's 4th Wing, which took off from Grosseto on a \"decollo immediato,\" or scramble order, after \"a report of a suspected threat aboard a civilian aircraft,\" and escorted it to Fiumicino, where it landed at 10:45 a.m., [ANSA reported](https://ansa.it/sito/notizie/cronaca/2026/11/03/falso-allarme-bomba-aeronautica-decollo-immediato-di-due-eurofighter_d345c392-a96f-472a-9a25-f7a465072fd2.html). Checks were negative.\n\n**Spain.** The airport operator Aena activated an emergency protocol for a Ryanair flight from Manchester to Murcia, which landed at 10:30 a.m. without incident. Francisco Lucas, the Spanish government's delegate in the Murcia region, said 121 people were on board, including crew; the Guardia Civil found no explosives, per AP and dpa.\n\n**Bulgaria.** Two aircraft, a Wizz Air flight from Bergamo and a Ryanair flight from Dublin, received threats en route to Sofia. Neither was diverted. Transport Minister Georgi Peev said one threat was first reported by the pilot, who learned of it through airline channels, and that counter-terrorism officers found no explosives after landing, AP reported, citing the BTA news agency.\n\n**United Kingdom.** The Metropolitan Police said it was \"aware of threats made on the morning of Tuesday, November 3 against four aircraft\" due to depart from or arrive at Heathrow, and \"a further threat against an aircraft at Manchester Airport.\" \"Following an assessment by the respective airlines, no security issues were identified,\" the force said, [per dpa](https://www.yahoo.com/news/world/articles/two-planes-travelling-uk-europe-004833363.html). Counter Terrorism Policing said it was aware of the European incidents but that there was \"no active investigation by CTP into any of these matters.\" A government spokesperson called them \"malicious hoax threats\" and said \"the UK has one of the most robust aviation security systems in the world.\" The wires did not explain how the four Heathrow aircraft relate to the LOT flight, which also departed Heathrow.\n\n**Greece.** The Panama-flagged cruise ship Crown Iris, operated by the Israeli line Mano Maritime, was evacuated at Syros after port authorities were told an explosive device had been placed on the hull. The ship was carrying 940 passengers and 597 crew and was due to sail for Haifa, [To Vima reported](https://www.tovima.com/society/greek-authorities-investigate-bomb-threat-aboard-cruise-ship/). Coast guard officers searched with an explosives-detection dog and a diver, found nothing, and called in the Hellenic Coast Guard's underwater operations unit for a second inspection, [Cruise Hive reported](https://www.cruisehive.com/bomb-threat-holds-crown-iris-in-greek-port-for-hours/222524). The ship was still in port at about 10 p.m., several hours behind its 5 p.m. departure. Local authorities had banned a planned anti-war protest on the Ermoupoli waterfront the day before, saying the location \"posed a severe threat to public security,\" and moved it elsewhere.","textStyle":"body","layout":"text"},{"role":"htmltable","html":"<table><tr><th>Flight or vessel</th><th>Route</th><th>Response</th><th>Result</th></tr><tr><td>LOT 737 MAX</td><td>Heathrow to Warsaw</td><td>Diverted to Modlin; airport closed</td><td>Nothing found</td></tr><tr><td>SAS SK751</td><td>Copenhagen to Warsaw</td><td>Landed as planned; runway closed</td><td>Nothing found</td></tr><tr><td>Ryanair (Lisbon)</td><td>Lisbon to Rome</td><td>Searched at Fiumicino</td><td>Nothing found</td></tr><tr><td>Ryanair FR9611</td><td>Dublin to Rome</td><td>Eurofighter escort</td><td>Nothing found</td></tr><tr><td>Ryanair (Manchester)</td><td>Manchester to Murcia</td><td>Emergency protocol</td><td>Nothing found</td></tr><tr><td>Wizz Air (Bergamo)</td><td>Bergamo to Sofia</td><td>Searched after landing</td><td>Nothing found</td></tr><tr><td>Ryanair (Dublin)</td><td>Dublin to Sofia</td><td>Searched after landing</td><td>Nothing found</td></tr><tr><td>Crown Iris</td><td>Syros to Haifa</td><td>Evacuated; divers searched hull</td><td>Nothing found</td></tr></table>","layout":"text"},{"role":"body","format":"markdown","text":"Sources: [AP via PBS](https://www.pbs.org/newshour/world/flights-across-europe-face-disruption-after-false-bomb-threats), [AFP and Reuters via Al Jazeera](https://www.aljazeera.com/news/2026/11/4/bomb-threats-disrupt-flights-across-europe-no-explosive-devices-found), [dpa via Yahoo News](https://www.yahoo.com/news/world/articles/two-planes-travelling-uk-europe-004833363.html), [To Vima](https://www.tovima.com/society/greek-authorities-investigate-bomb-threat-aboard-cruise-ship/). The Metropolitan Police's four Heathrow aircraft are not listed separately because the wires did not identify them.\n\n## How the threats arrived\n\nThe method varied, which matters for anyone trying to tie the incidents to one sender. The Rome threat about the Lisbon flight came by email, AP reported; dpa described the Dublin-to-Rome warning as an anonymous phone call. In Bulgaria, one threat reached the pilot through the airline's own channels. Bulgarian media reported that an earlier threat against a flight to Sofia was sent by email. Hungary's Defense Minister, Romulusz Ruszin-Szendi, said Monday's Luton-to-Sofia alert was flagged by NATO's air-defense alert service, after which Hungarian Gripen jets scrambled to escort the Wizz Air plane to Budapest, [AFP reported](https://www.malaymail.com/news/world/2026/11/04/bomb-threats-target-10-european-flights-in-hours-forcing-airport-closures-and-fighter-jets-to-scramble/241874). Bulgaria's acting Interior Ministry secretary general, Lyubomir Nikolov, said on Tuesday that authorities were still trying to identify who sent that message.\n\n**Two days of bomb threats against European flights and a cruise ship**\n\n* **2026-11-02**: Wizz Air Luton to Sofia diverted to Budapest under Hungarian Gripen escort\n* **2026-11-03**: 9:40 a.m., Ryanair from Lisbon lands at Rome Fiumicino after email threat\n* **2026-11-03**: 9:54 a.m., LOT Heathrow to Warsaw receives alert; lands at Modlin at 10:01\n* **2026-11-03**: 10:30 a.m., Ryanair Manchester to Murcia lands under emergency protocol\n* **2026-11-03**: 10:45 a.m., Ryanair FR9611 from Dublin lands at Rome under Eurofighter escort\n* **2026-11-03**: Afternoon, two Sofia-bound flights searched; SAS SK751 inspected at Warsaw\n* **2026-11-03**: Afternoon and evening, Crown Iris evacuated at Syros; divers search the hull\n\nSource: [AP via PBS](https://www.pbs.org/newshour/world/flights-across-europe-face-disruption-after-false-bomb-threats), [Reuters via ABC Australia](https://www.abc.net.au/news/2026-11-03/warsaw-airport-closed-after-unplanned-landing-of-london-plane/107343338)\n\nRhys Jones of the aviation advisory firm Osprey Flight Solutions told Reuters that seven confirmed threats in one day was exceptional. \"The lack of clear target state, airline or route indicates that general disruption to aviation operations is the aim,\" he said. His colleague Matthew Borie told AP there were several possible explanations: copycats following one threat, a single person or group making repeated calls, or \"hybrid warfare\" by state actors or their supporters. He said such threats are \"not a new phenomenon,\" that there \"could be a Russian angle,\" and that Iranian hybrid activity is also active in parts of Europe. He advised travelers not to be alarmed, pointing to national response systems that include fighter escorts.\n\nThose are analysts' hypotheses. No official in any of the six countries attributed Tuesday's threats to a state, and the one police force that addressed the question, Britain's Counter Terrorism Policing, said it was not investigating.\n\n## The context officials are reaching for\n\nEuropean governments have spent two years attributing a growing list of incidents to Russia and, in some cases, Iran. AP's account of Tuesday's threats placed them alongside drone incursions, the freezer attacks and unexplained triggering of public alert apps as suspected hybrid activity. Both governments deny involvement in sabotage, Reuters noted. How quickly European capitals now reach for a hostile-state frame, and how rarely they publish the evidence, was visible last week in Germany's [spyware warning to Bundestag members](https://567politics.com/news/germany-bundestag-iphones-spyware-bsi-apple-warning-november-2026). The supermarket freezer attacks of October and this week, in which controllers were set to 50°C, remain unattributed; France's cyber agency and Romania's cyber directorate have said the method was basic and that there is no evidence yet of a state behind it, as our [refrigeration report](https://567politics.com/news/europe-supermarket-refrigeration-cyberattacks-second-wave-november-2026) set out. Last month a Tel Aviv-to-Vienna flight made an emergency landing in Bulgaria after a bomb threat, AP noted.\n\nThe Crown Iris sits in a different context. The ship, which was on a seven-night Greek islands cruise from Haifa, has been the target of protests at Rhodes, Crete, Kefalonia, Corfu and Piraeus in 2026, To Vima reported, and in June a 37-year-old Palestinian man was arrested in Crete over a suspected plot against it, according to Cruise Hive. Whether Tuesday's threat was connected to the flight threats, to the protests, or to neither is unknown. The ship's Israeli ownership makes it a target for reasons that have nothing to do with Ryanair's Dublin schedule, and investigators have not said the cases are linked.\n\nThe Polish incidents land during a dispute between President Karol Nawrocki and Prime Minister Donald Tusk over who runs national security, which 567politics covered in its report on [the National Security Council meeting](https://567politics.com/news/poland-national-security-council-nawrocki-tusk-tribunal-quorum-november-2026). Neither man had commented on the Modlin diversion in the reports we read. Bulgaria, which fielded three of the week's threats, voted in a presidential runoff two days earlier; 567politics reported [Iliana Iotova's win](https://567politics.com/news/bulgaria-yotova-wins-presidential-runoff-gyurov-november-2026).\n\n## What the responses tell us\n\nThree different response models were on display. Italy and Hungary scrambled fighters, through NATO's integrated air-defense system, to escort civilian aircraft to the ground. Poland diverted a plane to a secondary airport and closed it. Britain let the airlines assess the threats and, finding them not credible, kept flights moving. All three ended with the same result, no device, and none of the three countries has said its approach was wrong.\n\nThe costs differ. A fighter scramble and an airport closure are visible and expensive; they also signal to whoever made the calls that a single email can move military aircraft. An airline-level assessment is cheaper and quieter; it also depends on the airline's judgment being right every time. Jones's observation that the aim appears to be \"general disruption\" cuts both ways. If disruption is the goal, the response itself is part of what the sender achieves. If the threat is real, the response is what saves lives. Officials in each country made that trade-off differently on Tuesday, and no one can yet say which call was correct, because no one knows who was calling.\n\n## Online reaction: what we could not verify\n\n567politics attempted to read Reddit's r/worldnews, r/europe and r/geopolitics listings and X's trending pages during this run. Every request to Reddit was refused and X's pages could not be read. Our tool for confirming a post's exact text, author and timestamp from its permalink failed for every X post we attempted, including a post by the Israeli broadcaster ILTV about the Crown Iris that appeared in search results. We therefore quote no social media posts in this article and make no claim about public sentiment in Poland, Italy, Spain, Bulgaria, Britain or Greece. We found no representative poll on these incidents. The absence of quoted posts reflects our access, not the volume of reaction.\n\n## What remains unknown\n\nWho sent the threats, how many senders there were, and whether any of Tuesday's incidents are connected to Monday's or to each other. The different delivery methods, email, phone and airline channels, are consistent with either a coordinated campaign or copycats; neither has been shown.\n\nWhether the Crown Iris threat is related to the aviation threats at all.\n\nWhether any arrests follow. Bulgaria said it was trying to identify a sender; Poland referred the SAS matter to police; Britain's counter-terrorism police said they were not investigating. No arrest had been reported in any country by late Tuesday.\n\nWhether governments will change procedures. Seven false alarms in a day, after Monday's diversion and last month's emergency landing in Bulgaria, is a pattern airlines and air-defense commands will have to decide how to price. None had announced a change by Tuesday night.","textStyle":"body","layout":"text"}]}