From flights to TV newsrooms: What is behind Europe’s bomb hoax wave?

What began as a string of bomb threats against passenger flights across Europe has now spread to television newsrooms, forcing evacuations, triggering military escorts and raising a more difficult question for governments: are they dealing with copycats, individual hoaxers or a coordinated campaign designed to keep Europe on edge?

According to Reuters, newsrooms in Ireland and Bulgaria received emailed bomb threats on Friday, while Britain’s Sky also reported a security alert, extending a wave of disruption that had already affected dozens of flights since Tuesday.

Ireland’s public broadcaster RTE evacuated its offices and temporarily suspended normal programming after receiving a message warning that a device would explode within 45 minutes. Bulgaria’s Nova TV also evacuated its newsroom before police searches found nothing.

The emails sent to RTE and Nova, as per Reuters, were signed by someone using the name “Mikhail Andropov” and carried the subject line “Message to the West”. The sender claimed responsibility for recent threats against aircraft and portrayed them as the beginning of attacks on transport infrastructure across Europe.

Reuters could not establish who sent the messages, where they originated or whether the same person was responsible for any of the aviation threats. No explosive devices have been found so far.

How did the flight threats begin?

The first wave emerged on Tuesday, when threats were reported against at least seven passenger flights and an Israel-bound cruise ship.

Aircraft travelling to destinations including Warsaw, Sofia, Rome and Murcia were searched or diverted, while one flight to Rome was escorted by Italian fighter aircraft. No explosives were found.

The disruption intensified on Thursday, when nearly 30 flights across Europe received threats. Some made unscheduled landings, while others were delayed, diverted or met by security teams after arrival.

Four aircraft heading for Prague alone received bomb threats. Czech police assessed their credibility as low but still activated security procedures and arranged explosive searches after landing.

Friday brought fewer flight disruptions, but the targets widened.

A Wizz Air flight from Prague to Rome was diverted to Venice following a bomb scare, while military aircraft were again used to escort some passenger planes. NATO also became involved through additional air patrols in the region, according to officials cited by Reuters.

The move into television newsrooms means whoever is sending at least some of the threats is no longer concentrating solely on aviation.

Why can a fake threat cause so much disruption?

The reason is straightforward: authorities cannot treat a bomb warning as false simply because previous threats turned out to be hoaxes.

Aviation security teams must assess each warning individually. Depending on the perceived risk, an aircraft may need to be diverted, isolated after landing, searched by bomb-disposal teams or escorted by military jets.

That response can cost far more than it costs to send the threat.

A single anonymous email can force an aircraft to consume additional fuel, disrupt crew schedules, close parts of an airport, delay hundreds of passengers and affect connecting flights across an airline’s network.

Security experts told Reuters that this imbalance, very low cost for the perpetrator, potentially high cost for the target, is one reason hoaxes can be attractive as a disruptive tactic.

The same principle applies to broadcasters.

RTE was forced to evacuate employees and replace normal programming for several hours after Friday’s warning. Even without an explosive device, the sender succeeded in disrupting a national broadcaster and forcing police and security services to respond.

Why are officials talking about ‘hybrid warfare’?

The scale and timing of the incidents have led some European officials to examine them through the wider lens of hybrid or “grey-zone” operations.

Spanish Foreign Minister Jose Manuel Albares described what Europe was facing as “hybrid aggression and a form of psychological warfare”.

Hybrid activity generally refers to attempts to weaken or destabilise another country without resorting to conventional military conflict.

The European Union defines hybrid threats as coordinated harmful activities that can combine cyberattacks, information manipulation, economic coercion, covert political activity and other methods while making responsibility difficult to establish.

Their value lies partly in ambiguity.

A government may know that someone is deliberately disrupting its infrastructure but struggle to prove who is responsible. That makes retaliation more difficult and allows the perpetrator to deny involvement.

NATO similarly says hybrid tactics such as sabotage, cyber operations, deception and information manipulation are intended to destabilise societies and blur the distinction between peace and conflict.

Bomb hoaxes fit some aspects of that model particularly well: they are inexpensive, difficult to attribute and force authorities to respond every time.

Why is Russia being discussed?

The suspicion surrounding the latest incidents is heavily influenced by what has happened elsewhere in Europe since Russia’s full-scale invasion of Ukraine in 2022.

European governments have accused Moscow or Russian-linked actors of involvement in sabotage, cyberattacks, damage to critical infrastructure, electronic interference and influence operations.

The EU says Russian hybrid activity has intensified since the invasion of Ukraine, including sabotage, cyber operations, attacks on infrastructure and attempts to undermine democratic institutions.

NATO has similarly accused Russia of conducting a broader campaign involving critical infrastructure sabotage, malicious cyber activity, electronic interference and disinformation against Allied countries.

EU Technology Commissioner Henna Virkkunen told Reuters this week that Europe had faced an array of such operations since 2022.

“We are under attack all the time,” she said, arguing that their purpose was to destabilise societies and undermine public trust.

But she also stressed that Russia was not responsible for every hybrid incident.

“It’s not always Russia,” she said. “Quite often it is Russia.”

That distinction is crucial in the current case.

No government, however, has publicly produced evidence showing that Russia is behind this week’s bomb threats. Moscow has denied involvement in wider European hybrid campaigns.

Are the Russian references themselves evidence?

Not necessarily.

Some of the threatening messages contain references that appear deliberately Russian.

Threats sent to airlines and airport operators in Italy on Thursday purported to come from “fighters of the Male State”, the name of a far-right anti-feminist movement that was banned in Russia.

The group’s founder, Russian blogger Vladislav Pozdnyakov, told Reuters that the movement no longer existed and denied any involvement.

Friday’s emails to RTE and Nova were signed “Mikhail Andropov”.

But using Russian names or organisations does not establish Russian responsibility.

Those references could reflect a genuine connection, an individual imitating Russian extremist groups or someone deliberately leaving a false trail to encourage investigators and the public to blame Moscow.

Security experts have therefore cautioned that several possibilities remain open.

The threats could form part of a coordinated campaign aimed at European countries supporting Ukraine. They could also come from individuals pursuing political or personal grievances, separate online groups or copycats inspired by the attention generated by earlier threats.

So what is actually going on?

At this stage, European investigators have a clear pattern of disruption but no publicly identified perpetrator.

The threats have spread rapidly between countries and targets. They have affected airlines, airports, a cruise ship and now television broadcasters. They have forced diversions, searches, evacuations and military responses, yet no bomb has been discovered.

That is why the question of whether they constitute hybrid warfare remains unresolved.

Irish Prime Minister Micheál Martin said authorities had yet to establish whether Friday’s incidents were the work of individuals or part of a coordinated campaign, while warning that such threats could easily generate fear and disruption.

If investigators eventually establish coordination or state sponsorship, the episode could become another case in Europe’s growing confrontation with hybrid operations.

If they do not, the disruption still demonstrates the problem facing governments and airlines: a bomb threat does not have to be real to work.

As long as authorities cannot know which warning might be genuine, every new message forces them to make the same calculation again.