Are planes and train stations in Europe being rigged with bombs, and who is behind it?

Partly true. The threats happened: on 3 November about seven flights and a cruise ship, on 5 November at least 27 flights (almost 30 by evening) in 14 countries, from Ireland to Bulgaria. An Aer Lingus Dublin–Rome flight was diverted to the French air base at Évreux; Finnair Helsinki–Rome and three planes in Bulgaria were escorted by fighter jets. But no explosives were found on any plane. These were anonymous hoax emails, not planted bombs.^[1][2][3][6]

No evidence. All reports we found from October–November 2026 concern planes and airports. The only recent station case was on 7 October in Lublin, Poland: bomb emails hit more than a dozen sites, including the station, which was evacuated; nothing was found. Separately, Italian schools received bomb emails on 19 October and 2 November — also empty.^[13][14][11]

No. Searches in Madrid, Bulgaria, Warsaw, Milan, Évreux and other airports found nothing. Czech police rated the threats' credibility as low; the UK government called them "malicious hoax threats".^[2][3][1]

Unverified. According to Italy's ANSA news agency, an email to Rome airport titled "Threat report" was signed by "fighters of the Male State" (an anti-feminist movement founded by blogger Vladislav Pozdnyakov and banned in Russia). Reuters could not verify who sent it. Pozdnyakov says the movement no longer exists and someone is "using someone else's flag". A signature in an email proves nothing on its own: anyone can write it.^{[9][10][8][2]}

Not proven. EU transport commissioner Apostolos Tzitzikostas said it is "too early to draw conclusions" on whether the cases are linked. No government has named a culprit; Russia and Iran deny involvement. Experts allow for both a coordinated operation and lone actors or copycats; a NATO analyst quoted by El Español: "we don't have evidence yet".^[3][8][2][7]

No link found. The hack of Adif (Spain's rail infrastructure manager) and Renfe was in late September; the Extremadura health-data breach was disclosed in October and a suspect arrested; La Laguna city hall on Tenerife was hit on 2 November. No authority links these cases to the flight threats. The theory that hackers caused the train collision near Urda (Toledo) on 28 October is unsupported: Spain's transport minister blamed a failure of the train control system and a control-centre error (Maldita fact-check).^{[15][16][17][18][19][20][7]}

Lublin, Poland: bomb emails hit more than a dozen sites, including the train station and schools. The station is evacuated; nothing is found.^[13]

An Austrian Airlines Tel Aviv–Vienna flight lands in Sofia after a threat, escorted by a Bulgarian fighter jet. Nothing is found.^[2]

Italy: about 100 schools receive bomb emails; some are evacuated. Nothing is found.^[14]

A Wizz Air London–Sofia flight lands in Budapest escorted by a Hungarian fighter jet. The same day a bomb email reaches 271 schools in Italy.^[2][14]

First wave: threats to about seven flights (Ryanair, LOT, SAS and others) and a cruise ship. Ryanair Manchester–Murcia: Murcia airport closed for over two hours; LOT diverts to Modlin near Warsaw. Nothing is found.^[6][2]

Second wave: at least 27 flights, almost 30 by evening. Aer Lingus Dublin–Rome lands at the Évreux air base, Italian fighters escort Finnair Helsinki–Rome, Iberia and Air Europa flights are checked in Madrid. Nothing is found.^[1][2][7][5]

Italian media report the email was signed by "fighters of the Male State". The movement's founder denies involvement; Reuters cannot confirm the signature.^[9][10][8]

"Too early to draw conclusions" on whether the cases are linked; any threat to civilians is "unacceptable".^[3][4]

Analyses of the "hybrid attack" theory: experts see a familiar pattern but no evidence. No new waves of threats on 6 November in the sources found.^[7][2]

At least 27 flights, 14 countries, no explosives found, no country has blamed anyone; Russia and Iran deny involvement.^[1]

Full timeline since 18 October; the "Male State" claim is unverified; experts: looks like hybrid tactics but is hard to prove.^[2]

EU transport commissioner: too early to say whether the cases are linked; threats came from anonymous addresses, Czech police rated them not credible.^[3][4]

Spanish experts call the wave a "textbook hybrid attack" but admit there is no evidence yet. Also notes the attacks on supermarket fridges — and that no link to the flight threats is proven.^[7]

Retell Italian media on the "Male State" signature and its founder's denial.^[9][10]

Claims that hackers or Israel caused the train crash near Urda are unsupported; the transport minister blames a system failure and a control-centre error.^[20]

The wave is widely retold as "mining of planes in Europe". We found no viral posts specifically about "mined train stations"; we did not browse social networks directly and could not estimate reach.^[11][12]

2026-11-05

Outcome: More than 90 sites searched, nothing found; sender not identified. Serbia's interior minister spoke of "special warfare" without evidence.^[21]

Outcome: No explosives found anywhere; a 17-year-old was arrested over some of the threats.^[22]

Outcome: Fake: the apps were hacked and the alerts were false. Who was behind the hacks is unproven.