A wave of anonymous emailed threats diverted or delayed nearly 30 flights in at least ten countries, and no government has yet said who sent them.

Intelligence Lead

Anonymous bomb threats emailed to airlines and airports on 5 November forced fighter-jet escorts, diversions and ground searches across much of Europe, in what experts describe as a coordinated pattern. No device has been reported found and no government has attributed the campaign. Its strategic value, assessed with low confidence, lies in measuring how quickly European air defence and civil aviation respond under pressure.

Situation Report

Reuters, RTÉ and Al Jazeera report that at least 27 passenger flights, and by Reuters' count nearly 30, were affected on Thursday 5 November. An earlier wave on 3 November hit at least seven flights and a cruise ship, and briefly closed an airport outside Warsaw, according to RTÉ. Further threats were reported against broadcasters, though details of that strand remain thin in the sources reviewed.

The most dramatic incident involved Aer Lingus flight EI402, Dublin to Rome. Prime Minister Sébastien Lecornu's office said French fighters intercepted and escorted the aircraft to Évreux air base west of Paris because the pilot "did not cooperate with authorities as expected." The office gave no reason. A bomb unit attended, 151 passengers and six crew were moved to safety, and a regional prosecutor said both pilots were questioned. Aer Lingus said its pilots "fully co-operated." That account of the pilots' conduct is disputed and unresolved.

Bulgaria's air force escorted three airliners to the ground, two to Sofia and one to Plovdiv; its transport ministry said inspections found no issues. Spanish police reported three emailed threats within 20 minutes targeting Air Europa and Iberia services. Poland, Denmark, Romania, Italy, Austria, Belgium and the Czech Republic also reported threats or searches. Czech police said their counter-terrorism and cybercrime centre had taken over the investigation. All reported inspections have been negative.

A Reuters source at Italian airports described an email titled "Threat report," sent to airline, airport and service-provider addresses, claiming to come from "fighters of the Male State." It said devices were aboard inbound flights and would detonate within 60 minutes. Reuters could not confirm the sender. Vladislav Pozdnyakov, the Russian blogger who founded the "Male State" movement, said it no longer exists and that anyone using the name is "flying someone else's flag." That statement is his claim and is unverified.

Background & Context

European officials have accused Russia of a rolling campaign of sabotage and hybrid activity, including a drone incident at Leipzig airport that Germany blamed on Moscow in August. Denmark, Poland and Romania have previously named Russia directly. Such operations are cheap, deniable and unlikely to provoke an armed response. Russia and Iran, which the UK recently linked to a suspected plot against a US air base, both deny involvement in European sabotage.

Bomb hoaxes themselves are routine, and Coventry University's Philip Baum noted the diversion count was unusual while the threats were not. What has changed is the apparent coordination across jurisdictions and the willingness of states to scramble military aircraft in response. EU Transport Commissioner Apostolos Tzitzikostas said it was too early to say whether the incidents are linked.

Analysis & Assessment

The pattern fits a low-cost probe: a single template email, multiple targets and a deadline, designed to trigger visible national responses. Aviation analyst Eliran Almog argues such hoaxes can both disrupt operations and let an adversary observe how airlines, airports and authorities react. That reading is plausible. Each interception reveals alert times, handoff procedures between air forces and civil controllers, and which airports escalate to fighter escort.

Attribution should be treated cautiously. The "Male State" label points toward Russian-speaking networks, but the movement's founder disowns it, and a borrowed name is consistent with either a false flag or a criminal or hacktivist actor. Analyst Eric Schouten's remark that the activity "fits the modus operandi" of Russian hybrid operations is a pattern judgement, not evidence. Absent technical findings on the email infrastructure, state sponsorship remains a hypothesis. A non-state or opportunistic actor cannot be excluded.

The likely trajectory is repeat waves that vary targets and timing, with the aim of eroding response discipline and public confidence. Investigators will look for shared mail infrastructure, language artefacts and timing against military or political events.