Experts believe Russia may be behind a wave of hoax bomb threats that disrupted air travel across Europe and forced several passenger aircraft to undergo emergency security checks and diversions.
At least seven planes, including three operating from Britain, were targeted on Tuesday. The incidents prompted concern that the alerts could form part of a coordinated sabotage campaign linked to Vladimir Putin’s Kremlin.
The threats came amid growing fears that Moscow has widened its hybrid conflict with NATO. In recent days, cyberattacks have reportedly disrupted refrigerators and freezers in supermarkets across seven European countries.
Russian forces have also shown signs of preparing for a possible new incursion, after Putin warned last week that a conflict with the West would produce “no winners”.
“From railways to food infrastructure, including the reports of hacked refrigerators and all kinds of other operations, it fits the pattern of Russian state actors seeking to disrupt Europe,” said Eric Schouten, head of aviation security group Dyami.
Security and intelligence specialist Professor Anthony Glees said it was “highly likely” that Putin was responsible.
Speaking to GB News, he said: “There’s a kinetic shadow war going on against us, but there’s also a secret subversive war using disinformation—which is what hoaxes are.
“They create mayhem and can trigger panic. They test our resilience. This is a very good time for Putin to challenge us. We are not yet ready to fight seriously, so there is plenty of room for him to wage a grey war against us.”
Sections of an airport in Murcia, southeastern Spain, were cordoned off after a “written security threat” was reported on a Ryanair flight from Manchester. The aircraft landed as scheduled.
Defence analyst and former Army Lieutenant Colonel Stuart Crawford said the bomb alerts could represent a “coordinated sub-threshold attack” directed by Moscow.
“I suspect European security services have a fairly good idea of what is happening,” he said, while cautioning that investigators would need more time before formally attributing the incidents to Russia.
On Tuesday, threats were reported against at least two flights bound for Warsaw, two heading to Sofia, two travelling to Rome and one flying to Murcia in Spain. Another Sofia-bound service had received a threat the previous day.
A LOT Polish Airlines flight from London Heathrow to Warsaw Chopin Airport was diverted to nearby Warsaw Modlin Airport. The airport was temporarily closed and later reopened after the aircraft was searched and no explosive device was found.
A separate Scandinavian Airlines flight from Copenhagen reached Warsaw Chopin as planned. Police and bomb-disposal teams met the aircraft and subsequently confirmed it was safe.
Later that day, bomb experts searched two Ryanair aircraft at Rome’s Fiumicino Airport after anonymous reports warned of possible explosives. One plane had flown from Lisbon and the other from Dublin. The Dublin service was escorted by the Italian air force before landing.
Threats were also issued against flights from Milan/Bergamo and Dublin to Sofia, Bulgaria.
Both aircraft landed safely, and inspections found no explosives.
The Bergamo service was operated by Wizz Air and carried 176 passengers. The Ryanair flight from Dublin had 186 people on board.
In Murcia, parts of the airport were sealed off after authorities received reports of a “written security threat” on a Ryanair flight from Manchester. The plane arrived as scheduled.
One passenger said she did not know about the suspected bomb threat until the aircraft had landed.
“We weren’t told anything during the flight,” Sarah told BBC 5 Live. “The aircraft stopped quite suddenly, and then we were kept on the runway for 30 minutes.
“The fire engines and bomb squad arrived, and we were told to evacuate.”
She said the plane had been on the ground for less than a minute before it was “surrounded by police and a bomb squad”.
Passengers were escorted away from the aircraft and walked from the runway to the terminal, leaving their luggage behind.
“It was only later that we were told it was a genuine threat—a bomb threat against the plane itself,” she said.
A day earlier, a Wizz Air flight from London to Sofia was diverted to Budapest after a bomb warning was received.
All of the aviation incidents were ultimately declared false alarms.
On the Greek island of Syros, an explosives detection dog and a diver searched the Panama-flagged cruise ship Crown Iris after an unidentified caller claimed a device had been attached to the vessel’s hull.
No government has publicly blamed a specific country for the aircraft threats. However, the incidents occurred as European officials increasingly accuse Russia and Iran of carrying out “hybrid attacks” and sabotage operations.
Both Moscow and Tehran deny conducting such campaigns.
The latest warnings also followed a cyberattack that disrupted supermarket refrigerators in several European countries.
Some analysts believe the false bomb alerts may be part of the same broader pattern of inexpensive and difficult-to-attribute disruption.
A LOT Polish Airlines flight left London Heathrow on Tuesday morning for Warsaw Chopin Airport before being diverted to Warsaw Modlin after the security alert.
KEEP READING: California Prop 40 Results: Voters Decide on Billionaire Tax Measure
Passengers at Murcia Airport after the bomb warning involving a Ryanair flight from Manchester.
A police officer and sniffer dog inspect a Ryanair aircraft and its baggage in Murcia, Spain.
The Ryanair aircraft was carrying 121 people, including crew, according to Francisco Lucas, the Spanish government’s representative in Murcia.
A cyberattack that spread through European supermarkets on Monday disabled refrigeration systems, forcing stores to discard food. The incident affected businesses from Sweden to Belgium and echoed a similar attack in France the previous month.
The breach caused temperatures inside refrigerators and freezers at dozens of stores to rise. Ahold Delhaize and Colruyt locations in Belgium and Luxembourg were affected, as were Swedish supermarket chains ICA and Coop. At least one IKEA store also reported disruption.
Around 40 Delhaize supermarkets in Belgium and Luxembourg were targeted. A smaller number of stores in Sweden, Ireland, the Netherlands, Estonia and Finland were also hit.
“Everything is destroyed,” Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters during a visit on Monday. She said the attack began at about 2am but was not detected until several hours later.
“There has been a cyberattack, and all our freezers reached 50 degrees Celsius.”
A spokesperson for privately owned ICA said the company was aware that a “limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems”.
The incidents followed an attack in France last month, when police said hackers took control of cooling systems at hundreds of supermarkets, causing fires and food losses. Ahold also reported a cybersecurity incident to police during the same period.
Moscow has repeatedly rejected accusations that it is involved in sabotage or hybrid warfare operations.
Nevertheless, tensions across Europe remain high after Putin recently said Russia was prepared for a major war.
“Many people keep talking about preparing for war by 2030. Is that right or wrong?” Putin said during a press conference in Moscow on Thursday.
“First of all, we are ready, but we do not want any war with Europe. As for them, if anyone wants it, let them prepare.”
Western intelligence officials have warned that the Russian leader has an “appetite” for expanding sabotage operations in Europe, raising fears that the campaign could contribute to a wider conflict by 2030.
European governments have responded by strengthening security measures. Polish Prime Minister Donald Tusk said on Tuesday that he had deployed armed forces to the Russian border amid concern about a possible incursion.
Tusk said Poland had thwarted a potential “provocation” near the border with Russia’s Kaliningrad exclave on Monday night. He said he was informed shortly after midnight about suspicious activity along the country’s northern frontier.
“We very quickly mobilised the necessary security forces and resources, and successfully prevented any attempted act of provocation, if that was the intention,” Tusk said. “Of course, we will never be able to confirm that completely.”
He said the incident followed weeks of warnings from Polish and allied intelligence agencies about possible “acts of diversion or more serious provocation” along the EU and NATO borders with Russia. Those scenarios could include “the intrusion of armed individuals into Polish territory”, he added.
Tusk warned that Poland could face a prolonged “escalation from the Russian side” and urged the public to remain alert to sabotage attempts and other security threats.
Poland, positioned on the eastern flank of both the EU and NATO, has repeatedly accused Russia of sabotage since Moscow launched its full-scale invasion of Ukraine in 2022.
In September, Tusk said Russia’s military plans included hybrid attacks involving drones and missiles against countries supporting Kyiv.
Separately, Romanian authorities said they had uncovered a sabotage network whose members were allegedly acting for Russian intelligence agencies and preparing attacks on defence-industry sites in the European Union.
The Romanian Intelligence Service said the group had been involved in planning an arson attack against the Carfil arms factory in Brașov.
Investigators said three citizens of post-Soviet countries who were legally resident in EU states had taken part in preparations for the operation.
According to the intelligence service, the network’s activities extended beyond Romania.
Russian operatives had allegedly identified potential targets throughout the region, including state-owned and private defence manufacturers and other sites connected to the military.
The developments come as US-brokered negotiations between Kyiv and Moscow are expected to take place in Abu Dhabi next week.
The dates for the latest round—the first since February—were announced hours after a series of Russian strikes hit an aid distribution point in the southeastern Ukrainian village of Komyshuvakha, killing at least 33 people.
German Chancellor Friedrich Merz said he had yet to see evidence that Russia was prepared to participate seriously in talks aimed at ending the war.
“It is important that Russia finally and seriously engages in negotiations on a ceasefire and a subsequent peace agreement,” Merz said alongside Ukrainian President Volodymyr Zelensky in Berlin when asked about the US-backed trilateral discussions.
“I do not see that happening so far.”
