Seven flights bound for Warsaw, Sofia, Rome and Murcia received bomb threats this Tuesday, which forced a plane to be diverted, two airports to be temporarily closed and bomb squads to be mobilized in four countries. All have landed without incident and no explosives have been found. On Monday, another plane flying from London to Sofia had to divert to Budapest, escorted by a Hungarian fighter. For now, no one has claimed responsibility for the threats and the authorities of the affected countries have not attributed responsibility, although different experts maintain that it cannot be a coincidence.
Eric Schouten, a former Dutch intelligence agent specialized in aviation and director of the security consultancy Dyami, warns that, although there is no direct attribution, “the interruption of services is currently part of the modus operandi of state actors.” Even so, he points out that there are affected countries that are not necessarily among Moscow's objectives, such as Spain or Italy, which is why he is "cautious" when it comes to attributing the threats to the Kremlin.
Four of the seven flights were Ryanair. According to Schouten, this may mean that someone wants to harm these operators or that their protocols in these situations are different from those of the others, so other airlines may have received similar threats and have discarded them earlier.
Paul Mason, an expert in aviation security, has explained to the BBC that these threats “do not occur that frequently” and that the fact that they have been credibly made against several airlines suggests “a very deliberate act”, rather than a series of malicious calls that coincide.
Isolated warnings are frequently handled at airports, but rarely do so many coincide. “It is very exceptional that so many bomb threats occur and in such disparate places at the same time,” explains José Sanz, consultant for the International Air Transport Association (IATA) and former deputy director of the Madrid-Barajas airport. “Evidently it is not normal, and especially in Europe,” agrees Francisco Cruz, commander and collaborator of the Technical Department of the Sepla pilots union.
The threats come as European authorities accuse both Russia and Iran of carrying out what they describe as “hybrid attacks” and acts of sabotage, some of them against aviation. In December 2025, the German government attributed a 2024 cyberattack against the company that manages its air traffic control to Russian military intelligence and summoned the Russian ambassador. Moscow and Tehran deny being behind these types of campaigns.
Furthermore, this week, unidentified hackers have altered the refrigeration systems of supermarkets in several European countries, something that the European Commissioner for Agriculture, Christophe Hansen, has described as a “deliberate attempt to disrupt” the food supply. Most of the experts consulted consider that false bomb threats could be part of a similar pattern that fits with the way Russian state actors who want to destabilize Europe act. Operations that are characterized by their low cost and difficult attribution.
On Monday, Italian public broadcaster RAI reported an email containing bomb threats sent to 271 schools in the country. The sender claimed to represent Iran's Islamic Revolutionary Guard Corps, an identity that has not been verified.
In Spain, a Ryanair plane from Manchester bound for the International Airport of the Region of Murcia has received a bomb threat on board that has activated the alert at the facilities, where a crisis committee has been set up. The airline's operations center received the notice during the flight and alerted the authorities, according to the Civil Guard.
The plane landed at 10:50 and, from that moment, a large security device has been put in place made up of emergency services, agents of the National Police and specialists in explosives deactivation (Tedax) of the Civil Guard. The bomb bombers have not found explosives, reported the Government delegate, Francisco Lucas, so the threat has been ruled out. The airport reopened at one in the afternoon, after more than two hours of closure, according to Aena.
The two flights bound for Warsaw were scheduled to land at Chopin, the city's main airport, but one of them, with 181 people on board, has been diverted to Modlin, located 36 kilometers from the capital. This airport, which had temporarily suspended its operations, resumed them a few hours later. Chopin, which received the flight from Copenhagen, has maintained its activity, although one of its runways has remained closed during the intervention.
When a warning arrives in mid-flight, the cabin crew searches for the possible device among seats, cabinets and luggage, while the pilots reduce the pressurization and speed in case the explosive is sensitive to changes in pressure. The goal is to land in about 30 minutes, Cruz explains. Whether the threat is credible or not is normally decided by the airline's operations control center, advised by security forces.
The response to these notices in Spain is established in the National Security Program for Civil Aviation, whose procedures are reserved, to the point that not even the pilots have access to them, according to Cruz. Sanz explains that threats are analyzed by sharing information between security forces, CNI, airlines and airports, and that the same authorities that decide if they are credible order the plane to land immediately or continue to its destination. Every threat is considered real until it is resolved, although most turn out to be false, explains Marco Chan, a former pilot and professor of air operations at Kingston University, to the BBC.
In Rome, Fiumicino airport has received anonymous tips about two Ryanair flights from Lisbon and Dublin, and the second has landed escorted by the Italian Air Force. Inspections have not found explosives.
In Sofia, a single email alerted that two other planes, from Bergamo and Dublin, had landed without diverting. The Bulgarian authorities have denied initial information that placed the origin of one of them in Israel. The Secretary General of the Ministry of the Interior, Lyubomir Nikolov, has assured that there is no information about “terrorist actions.”
The pilots demand that, in the event of any warning, the commander be informed as soon as possible. “The more information we pilots have, the better we can manage this situation,” summarizes Cruz.
