On November 3, 2026, seven flights across multiple European countries and a Panama-flagged cruise ship docked at Syros Island, Greece, received bomb threats. Security operations confirmed that no explosive devices were found on board any of the flights or the cruise ship following thorough inspections.
Flights Affected by Bomb Threats and Security Responses
Ryanair operated flights from Manchester, Lisbon, and Dublin were targeted by bomb threats. The Ryanair flight from Manchester, carrying 121 passengers, made an emergency landing at Murcia airport in southeastern Spain. Parts of Murcia airport were cordoned off but reopened after authorities found no explosives. Two Ryanair flights arriving at Rome Fiumicino Airport were searched
following threats; the Dublin flight was escorted by the Italian Air Force.
Flights to Warsaw included a LOT Polish Airlines service from London diverted from Warsaw Chopin Airport to Modlin Airport, which had been briefly closed for a search, with no devices found. An SAS flight from Copenhagen landed at Warsaw Chopin Airport on schedule without incident.
Two flights to Sofia, Bulgaria, were also threatened on November 3. A Wizz Air flight from Milan/Bergamo with 176 passengers and a Ryanair flight from Dublin carrying 186 passengers landed safely after inspections. The day before, another Wizz Air flight from London Luton
to Sofia was diverted to Budapest and escorted by a Hungarian Gripen fighter jet following a bomb threat.
Airport and Cruise Ship Operational Impact
Chopin Airport Warsaw was briefly shut but reopened after security services found no explosives. Rome Fiumicino Airport continued normal operations after clearing the threat linked to the Ryanair flights. Murcia Airport sealed off limited areas during the Ryanair Manchester flight investigation but resumed normal functions following clearance.
The Crown Iris cruise ship, carrying 1,537 passengers and crew bound for Israel, docked at Syros Island was evacuated and searched by the Greek Coast Guard after a threat indicated an explosive device might be
attached to its hull. Initial checks revealed no device, though further inspection was to be carried out before the vessel could continue.
Background and Possible Motivations Behind Threats
European officials have noted that recent hybrid attacks and sabotage acts are believed to originate from state actors such as Russia and Iran, though both countries deny involvement. The bomb threats on November 3 do not indicate a specific target state, airline, or route, suggesting a broader aim to disrupt aviation operations.
Unidentified hackers recently caused disruptions by shutting down supermarket fridges in several European countries. Experts suggest the bomb threat incidents may be part of similar low-cost,
deniable disruption tactics.
Traveller Impact and Official Statements
The bomb threats caused emergency landings, diversions, and security delays impacting passengers’ travel plans across Europe. The Bulgarian Transport Ministry confirmed threats against flights arriving in Sofia and stated no explosives were found. Hungarian Defence Minister Romulusz Ruszin-Szendi confirmed the diversion of the Wizz Air flight to Budapest. Warsaw Chopin Airport announced no explosives were detected and resumed normal function after brief closure. Rome Fiumicino Airport’s operator reported resumption of routine operations following the alerts.
Travel insurance implications arise from these security disruptions. The Association of British Insurers advises passengers to verify coverage, noting terrorism-related exclusions may
apply. Passengers may need to retain evidence of delays and expenses for claims.
Expert Analysis on the Bomb Threats
Rhys Jones, Analysis Output Manager at Osprey Flight Solutions, characterized the scale of seven bomb threats in one day as exceptional, highlighting the lack of a clear target state, airline, or route as indicative of an intention to cause widespread aviation disruption.
Eric Schouten, head of aviation security group Dyami, linked the bomb threats to a broader pattern of sabotage aligned with Russian state actor tactics aimed at destabilizing Europe, citing related cyber disruptions in infrastructure sectors.
