JupiteX Get the app
Defence & Security6 Nov 2026 · about 6 min

Bomb threats disrupt European airports: 25 flights diverted in a single day

The brief

At least 25 flights were diverted or forced into emergency landings across Europe. The disruption followed bomb threats sent to airport operators. The scale mattered because the alerts affected international aviation, not just one airport or one route. Italy was especially involved. The article says seven affected flights were either arriving in or departing from Italy, while eight cases were linked to Italy. Fiumicino Airport’s Terminal 3 received an Italian-language email. Sofia Airport administration in Bulgaria received a message with the same signature. The article does not identify every affected airport or country. It confirms that airports across Europe were placed on high alert. Investigators suspect a coordinated European wave and activated international cooperation channels to trace the emails. The threats came two days after at least seven false alarms on November 3.

01

How many flights were disrupted, and which countries or airports were among those affected?

At least 25 flights were diverted or forced into emergency landings across Europe. The disruption followed bomb threats sent to airport operators. The scale mattered because the alerts affected international aviation, not just one airport or one route.

Italy was especially involved. The article says seven affected flights were either arriving in or departing from Italy, while eight cases were linked to Italy. Fiumicino Airport’s Terminal 3 received an Italian-language email. Sofia Airport administration in Bulgaria received a message with the same signature.

The article does not identify every affected airport or country. It confirms that airports across Europe were placed on high alert. Investigators suspect a coordinated European wave and activated international cooperation channels to trace the emails. The threats came two days after at least seven false alarms on November 3.

02

What is a bomb threat, and why can it force a plane to divert or make an emergency landing?

A bomb threat is a message claiming that an explosive device is present, planned, or about to detonate. It creates a safety risk, even if the sender is bluffing. Aviation systems therefore respond to the possible danger before investigators know whether the warning is genuine.

A plane may divert to another airport or make an emergency landing so trained teams can isolate and inspect it. The article records at least 25 flights diverted or forced into emergency landings after threats. One email claimed an explosion would occur in 60 minutes, increasing the pressure to act quickly.

The article does not describe each airline’s decision process. In general, authorities assess the message, flight location, timing, and available emergency facilities. They may raise the alert level and restrict normal operations while checks take place. The November 3 alarms were later found to be unfounded, but that outcome could not be assumed immediately.

03

What happens to passengers, airport operations, and air traffic when a threat is reported?

When a threat is reported, airport staff and aviation authorities place safety before schedule. They may raise the alert level, inspect aircraft or facilities, and separate a potentially affected flight from normal operations. These steps protect passengers while the warning is assessed.

The article shows the immediate effect. At least 25 flights were diverted or forced to make emergency landings. Airports across Europe went on high alert, and seven affected flights were arriving in or departing from Italy. Passengers would consequently face rerouting, delays, or interrupted journeys, although the article gives no passenger total.

Air traffic can also be disrupted beyond the directly targeted airport. Arrivals, departures, airport access, and aircraft movements may need to be managed more cautiously. The article does not list every operational measure. It reports that authorities treated the threats seriously, despite at least seven similar alarms two days earlier later proving unfounded.

04

Who or what is the Russian group calling itself “Male State,” and why was its name used in the emails?

“Male State,” or Muzhskoye Gosudarstvo, is described as a Russian ultranationalist and misogynistic movement. It was founded by Vladislav Pozdnyakov, identified as a Russian blogger and radical nationalist activist. The movement has been banned in Russia.

The threatening emails were signed by a group calling itself “Male State Fighters.” The message also attacked a “feminist system,” saying it would remember the group’s actions. That wording connects the email’s claimed identity with the movement’s described misogynistic outlook.

However, a signature is not proof of authorship. The article says the signatures point to the Russian movement, but investigators are still tracing the servers and IP addresses used to send the messages. It does not say that Male State members were confirmed as the senders. The name may have been used to claim responsibility, intimidate recipients, or mislead investigators; those possibilities are not resolved in the article.

05

Why do investigators suspect that the threats were coordinated across Europe rather than sent independently?

Investigators suspect coordination because the threats appeared across Europe in a single new wave. The pattern was broader than an isolated warning at one airport. Coordinated threats can create wider disruption and require authorities in different countries to compare evidence.

The strongest concrete link is the signature. An email sent to Terminal 3 at Fiumicino Airport was signed “Male State Fighters.” Sofia Airport administration received a similar message with the exact same signature. Both airports therefore saw messages connected by an identical claimed identity.

Timing also supports the suspicion. The new wave occurred on Thursday, only two days after at least seven false alarms on November 3. The article says international cooperation channels were activated to trace the servers and IP addresses. It does not report a final finding, so coordination remains an investigative suspicion rather than a proven conclusion.

06

How can international investigators trace threatening emails using servers and IP addresses?

Servers are computers or services that handle email delivery, while an IP address identifies a device or network connection online. Investigators can examine the technical records attached to a threatening email. These records may show which services handled the message and when it moved through them.

They can compare those details across messages. Matching server paths, timing, or IP information may reveal that emails came from a common source or were sent through related accounts. Investigators may then request records from service providers and work across borders to identify the person controlling the relevant connection.

The article says international cooperation channels were activated to trace the servers and IP addresses used to send the threats. It does not say what investigators found. Technical clues can also be incomplete or disguised, so tracing is an investigative process rather than immediate proof of the sender’s identity.

07

How do airports and aviation authorities decide what safety measures to take when a bomb threat may be a hoax?

When a bomb threat arrives, authorities must balance uncertainty with passenger safety. A message may be false, but waiting for certainty could expose people to danger. Airports and aviation authorities therefore assess the wording, timing, target, and apparent credibility, then choose measures that reduce possible harm.

The article records several outcomes of that approach. Airports across Europe went on high alert. At least 25 flights were diverted or forced into emergency landings. One message claimed an explosion would occur in 60 minutes, giving authorities a stated deadline to consider while deciding how urgently to act.

The article does not list the exact criteria or procedures used by each airport. It shows that earlier false alarms did not prevent a serious response to the new wave. Authorities also opened an investigation, activated international cooperation channels, and traced technical evidence. The balance is practical: protect people first, then determine whether the warning was genuine.

This brief was written by AI from the original reporting and checked by other models. Names, figures and quotes come from the source; read it for full context.

Read more in the JupiteX app

Pulse is free. New stories every 4 hours, each one broken into the questions that explain it.

Or read more news on the web