Are planes and train stations in Europe being rigged with bombs, and who is behind it?

Partly true. The threats happened: on 3 November about seven flights and a cruise ship, on 5 November at least 27 flights (almost 30 by evening) in 14 countries, from Ireland to Bulgaria. An Aer Lingus Dublin–Rome flight was diverted to the French air base at Évreux; Finnair Helsinki–Rome and three planes in Bulgaria were escorted by fighter jets. But no explosives were found on any plane. These were anonymous hoax emails, not planted bombs.^[1][2][3][6]

No evidence. All reports we found from October–November 2026 concern planes and airports. The only recent station case was on 7 October in Lublin, Poland: bomb emails hit more than a dozen sites, including the station, which was evacuated; nothing was found. Separately, Italian schools received bomb emails on 19 October and 2 November — also empty.^[13][14][11]

No. Searches in Madrid, Bulgaria, Warsaw, Milan, Évreux and other airports found nothing. Czech police rated the threats' credibility as low; the UK government called them "malicious hoax threats".^[2][3][1]

Unverified. According to Italy's ANSA news agency, an email to Rome airport titled "Threat report" was signed by "fighters of the Male State" (an anti-feminist movement founded by blogger Vladislav Pozdnyakov and banned in Russia). Reuters could not verify who sent it. Pozdnyakov says the movement no longer exists and someone is "using someone else's flag". A signature in an email proves nothing on its own: anyone can write it. On 6 November the emails to TV channels came from "Mikhail Andropov" instead (the surname of Soviet leader Yuri Andropov), who called himself the leader of the group behind the flight threats. Reuters could not verify the sender and writes that it is unclear whether the signature points to Russia or, on the contrary, is an attempt to frame Moscow. There is also a third signature: the 2 November email to 271 schools in Italy, which also mentioned a Ryanair Riga–Rome flight, was signed in the name of Iran's Islamic Revolutionary Guard Corps. Italian authorities have not confirmed this signature either. Analyst Anna Kruglova in the Irish Times: high-profile group names are used to "scare people and create chaos".^{[9][10][8][2][21][25][30][14][31]}

Not proven. EU transport commissioner Apostolos Tzitzikostas said it is "too early to draw conclusions" on whether the cases are linked. No government has named a culprit; Russia and Iran deny involvement. Experts allow for both a coordinated operation and lone actors or copycats; a NATO analyst quoted by El Español: "we don't have evidence yet". On 6 November the Irish government called the threats a "coordinated campaign" and Spain's foreign minister José Manuel Albares spoke of "hybrid aggression" by autocratic forces, but neither named a specific country or offered evidence. Irish Taoiseach Micheál Martin said European security services have not yet determined whether this is lone actors or a campaign. On 7 November the Paris prosecutor's office opened an investigation and is checking for a "possible link with foreign powers" — a hypothesis being tested, not an established fact. EU tech commissioner Henna Virkkunen, speaking to Reuters about hybrid attacks: "it's not always Russia" behind them, though "quite often" it is.^{[3][8][2][7][22][21][26][27][32]}

No link found. The hack of Adif (Spain's rail infrastructure manager) and Renfe was in late September; the Extremadura health-data breach was disclosed in October and a suspect arrested; La Laguna city hall on Tenerife was hit on 2 November. No authority links these cases to the flight threats. The theory that hackers caused the train collision near Urda (Toledo) on 28 October is unsupported: Spain's transport minister blamed a failure of the train control system and a control-centre error (Maldita fact-check).^{[15][16][17][18][19][20][7]}

Lublin, Poland: bomb emails hit more than a dozen sites, including the train station and schools. The station is evacuated; nothing is found.^[13]

An Austrian Airlines Tel Aviv–Vienna flight lands in Sofia after a threat, escorted by a Bulgarian fighter jet. Nothing is found.^[2]

Italy: about 100 schools receive bomb emails; some are evacuated. Nothing is found.^[14]

A Wizz Air London–Sofia flight lands in Budapest escorted by a Hungarian fighter jet. The same day a bomb email reaches 271 schools in Italy; it is signed in the name of Iran's Islamic Revolutionary Guard Corps and names a "bomb" on a Ryanair Riga–Rome flight. A school in Rome is evacuated; no bomb is found there.^[2][14][30]

First wave: threats to about seven flights (Ryanair, LOT, SAS and others) and a cruise ship. Ryanair Manchester–Murcia: Murcia airport closed for over two hours; LOT diverts to Modlin near Warsaw. Nothing is found.^[6][2]

Second wave: at least 27 flights, almost 30 by evening. Aer Lingus Dublin–Rome lands at the Évreux air base, Italian fighters escort Finnair Helsinki–Rome, Iberia and Air Europa flights are checked in Madrid. Nothing is found.^[1][2][7][5]

Italian media report the email was signed by "fighters of the Male State". The movement's founder denies involvement; Reuters cannot confirm the signature.^[9][10][8]

"Too early to draw conclusions" on whether the cases are linked; any threat to civilians is "unacceptable".^[3][4]

Analyses of the "hybrid attack" theory: experts see a familiar pattern but no evidence.^[7][2]

Emails titled "Message to the West" from "Mikhail Andropov": a bomb in the building "will explode in 45 minutes", "the clock is ticking". Recipients: RTÉ, Virgin Media, Newstalk and the Irish Independent (Ireland), Sky (UK), Nova TV (Bulgaria). RTÉ is evacuated and runs pre-recorded programming for up to three hours; Nova is evacuated without interrupting its broadcast. No explosives are found.^[21][23][22]

New threats: nine flights from Prague (none cancelled), four planes over France, a Wizz Air Prague–Rome flight diverts to Venice, Portuguese police check a Ryanair Lisbon–Rome flight, fighter jets escort three planes over Hungary, and police are at Copenhagen airport for a second day. All land safely; nothing is found.^{[22][24][28][29]}

CNBC: more than two dozen threats to flights in a week, all hoaxes (other outlets counted about 30 on 5 November alone — counts differ). The European Union Aviation Safety Agency (EASA): the direct risk from each such "prank" is low. No arrests reported, sender not identified.^[25]

The Paris prosecutor's office opens an investigation into threats against planes over France: it is looking for the senders and checking for a "possible link with foreign powers". It names no specific country.^[26][27]

Bomb emails to TV channels from "Mikhail Andropov", evacuations, nothing found; who is behind the signature is unknown — it could be a Russian trail or an attempt to frame Russia.^[21][22]

Why the wave is hard to stop: the threats are hoaxes, but each diversion costs an airline up to $250,000; the sender has not been identified.^[25]

At least 27 flights, 14 countries, no explosives found, no country has blamed anyone; Russia and Iran deny involvement.^[1]

Full timeline since 18 October; the "Male State" claim is unverified; experts: looks like hybrid tactics but is hard to prove.^[2]

EU transport commissioner: too early to say whether the cases are linked; threats came from anonymous addresses, Czech police rated them not credible.^[3][4]

Spanish experts call the wave a "textbook hybrid attack" but admit there is no evidence yet. Also notes the attacks on supermarket fridges — and that no link to the flight threats is proven.^[7]

Retell Italian media on the "Male State" signature and its founder's denial.^[9][10]

Claims that hackers or Israel caused the train crash near Urda are unsupported; the transport minister blames a system failure and a control-centre error.^[20]

The wave is widely retold as "mining of planes in Europe". We found no viral posts specifically about "mined train stations"; we did not browse social networks directly and could not estimate reach.^[11][12]

2026-11-05

Hasil: More than 90 sites searched, nothing found; sender not identified. Serbia's interior minister spoke of "special warfare" without evidence.^[33]

Hasil: No explosives found anywhere; a 17-year-old was arrested over some of the threats.^[34]

Hasil: Fake: the apps were hacked and the alerts were false. Who was behind the hacks is unproven.