The most prominent incident involved an Aer Lingus flight from Dublin to Rome, which was diverted to a military airbase in Evreux, Normandy, France. French Prime Minister Sebastien Lecornu’s office confirmed that the aircraft landed safely at 09:00 local time. All 151 passengers and six crew members were evacuated, and military bomb disposal teams conducted inspections. No hazardous materials were found, and the French government stated it was monitoring the situation in real time.
In Italy, a Finnair flight from Helsinki to Rome (Flight 1761) received an emailed bomb threat. The aircraft was escorted by Italian Air Force fighter jets upon approach to Leonardo da Vinci–Fiumicino Airport. An airport official, speaking on condition of anonymity, confirmed that security clearance procedures by police bomb disposal experts were completed with no explosives found. The presence of military escorts highlighted the high-profile nature of the threat, though the official noted the flight landed safely.
Czech police reported that four aircraft heading to Prague received bomb threats. Authorities assessed the credibility of the threats as low but activated all necessary security measures to minimize impact on airport operations. Following landing at Václav Havel Airport, the planes underwent pyrotechnic inspections which yielded negative results. Police emphasized that while the threats were deemed low-risk, they were not being underestimated.
In Bulgaria, three Ryanair flights bound for Sofia were targeted. Two flights, originating from Copenhagen and Madrid, landed safely at Sofia’s Vasil Levski Airport. A third flight, from London’s Stansted Airport, was diverted to Plovdiv Airport, the country’s second-largest hub. Bulgaria’s Transport Ministry confirmed that operations at both airports returned to normal after inspections identified no issues. Similarly, in Romania, a Wizz Air flight from Milan to Bucharest landed safely after receiving a threat; a crisis center was established at Henri Coandă International Airport, and 182 passengers and seven crew members were processed by pyrotechnic teams and emergency services.
Other affected flights included a LOT Polish Airlines service from Warsaw to Brussels, which landed at its destination where inspections found no suspicious items. A Wizz Air flight from Milan to Warsaw was redirected to Vienna. Additionally, two other flights—an Aegean Airlines service from Thessaloniki and a Ryanair flight from Porto—landed safely at Milan’s Malpensa airport after receiving security warnings.
The source of the threats remains unclear. European officials have increasingly linked such disruptions to “hybrid attacks” and sabotage, with some blaming Russia and Iran, though both Moscow and Tehran have denied involvement. The timing of these incidents is significant, as they coincide with other reported disruptions, including cyberattacks on supermarket refrigeration systems in France and various drone incursions in European airspace. These events have prompted authorities to warn that the hybrid threat landscape is evolving and that civil infrastructure remains a primary target for non-kinetic warfare.
Military and civil authorities are coordinating closely to manage the operational impact. In France, the diversion to a military base allowed for rapid deployment of specialized bomb disposal units. In Italy, the use of air force interceptors served as a deterrent and a rapid response measure, ensuring the aircraft’s safety during its final approach. While the immediate tactical threat was neutralized in all confirmed cases, the strategic implication is a sustained effort to degrade confidence in European air travel and strain security resources.
No civilian casualties were reported in any of the incidents. The disruptions, while significant, resulted in delays and logistical strain rather than physical harm. Authorities in the affected countries have reiterated that airport operations have largely resumed or are returning to normal as inspections conclude. The consistency of the threats across multiple airlines and countries suggests a coordinated campaign rather than isolated incidents.
Security experts note that while these specific threats were hoaxes, the operational response required—diverting flights, deploying military assets, and halting airport operations—demonstrates the vulnerability of civilian aviation to low-cost, high-impact disruption. The next focus for European intelligence and security services will be identifying the origin of the communications that triggered these alerts, as the pattern of targets suggests a deliberate effort to test and exploit gaps in cross-border security coordination.
