Albares believes there may be "an attempted hybrid attack" behind the wave of fake bomb threats against flights

A wave of false bomb threats targeted flights and other European institutions. The incidents mattered because authorities could not simply dismiss them as jokes. Each warning created a potential safety emergency and raised concerns about coordinated interference. Albares said there could be an “intento de agresión híbrida”, or hybrid aggression, behind the threats.

The disruption extended beyond aviation. Reports said cyberattacks forced delays to 12 flights and led to the evacuation of Sky News’s headquarters. Other headlines referred to threats against television channels and aircraft across Europe. IAG’s Gallego said the only available response was to follow established protocols.

The source does not identify the perpetrators or confirm a Russian role. It presents that possibility as a concern raised by coverage. The immediate reality was operational disruption, precautionary evacuations, and delays. The broader implication is that European institutions may need to prepare for incidents combining digital attacks, alarming messages, and pressure on transport and media systems.

A false bomb threat is a hoax message or report claiming that a bomb is present when no bomb exists. It can target an aircraft, airport, television station, or another institution. The source describes such threats affecting flights and European television channels. Their importance comes from the uncertainty: officials cannot know immediately whether the warning is fabricated or genuine.

Airlines, airports, police, and emergency teams therefore activate safety procedures. They may check aircraft, restrict access, stop boarding, move passengers, or evacuate buildings. These actions are not proof that a bomb exists. They are safeguards while specialists assess the warning and search for danger. IAG’s Gallego said the practical response was to follow protocols.

The source does not explain the exact investigative process or identify suspects. It does show why a hoax can cause real disruption. Even an empty threat consumes time, interrupts travel, and alarms the public. Repeated incidents can also test institutional resilience and create wider concern about coordinated attacks or hybrid aggression.

The clearest figure in the source is 12 delayed flights. That number shows the disruption was operational, not merely rhetorical. Aircraft movements were affected across Europe, creating delays for passengers and requiring airlines and authorities to apply emergency procedures. The reports frame the events as part of a wider wave of cyberattacks and false bomb threats.

The impact also reached media organizations. Sky News’s headquarters was evacuated, and other headlines referred to threats against television channels. The source mentions threats against planes and channels, but it does not provide a complete list of affected organizations or countries. Nor does it give the total number of threats, cancellations, passengers, or financial losses.

The available facts point to a cross-sector crisis involving aviation and broadcasting. Its mechanism was disruption through alarming warnings and cyberattacks, followed by precautionary action. The forward concern is scale: repeated incidents could create more delays, evacuations, and public anxiety even when authorities find no bomb.

After a bomb threat is reported, responsible authorities treat it as a possible safety emergency. They assess the message, secure the relevant area, and follow procedures designed to protect passengers, staff, and the public. The source gives one clear example: Sky News’s headquarters was evacuated. It also says 12 flights were delayed.

The key mechanism is uncertainty. A warning may be malicious or inaccurate, but officials cannot safely assume that at the start. They may pause boarding or aircraft movements, inspect locations, control access, and move people away from danger. These precautions explain how an untrue message can produce genuine delays and evacuations. IAG’s Gallego said following protocols was the available response.

The source does not list every step or say whether explosives were found. It does show that disruption is an intended or unavoidable consequence of precaution. When warnings arrive alongside cyberattacks, their effects can spread across transport and media organizations, increasing pressure on emergency teams and public confidence.

The source does not specify which agencies investigated the threats or coordinated the wider response. It names Albares as raising the possibility of hybrid aggression and quotes Gallego of IAG on following protocols. It also reports effects on flights and Sky News. Those details show concern and operational action, but not a confirmed investigative chain.

In established crisis practice, airlines and airports manage aviation safety, police investigate threats and secure sites, intelligence services assess possible foreign involvement, and governments coordinate national responses. Cybersecurity agencies may examine digital attacks. These roles overlap because a threat can affect an aircraft, a building, a network, and public communications at once. This general division is not stated in the source.

The present facts therefore support caution rather than a named attribution. The source does not confirm who sent the warnings, whether one group coordinated them, or whether Russia was responsible. Further investigation would be needed before assigning blame or deciding whether the incidents form a single campaign.

A hybrid attack uses several tools together rather than relying on one conventional assault. It may combine cyberattacks, deceptive or alarming messages, influence campaigns, and disruption of transport or public institutions. The aim can be to create confusion, consume resources, damage confidence, or pressure governments without open military conflict. This definition comes from established security usage; the source does not define the term.

The reported events illustrate how the pieces might connect. Cyberattacks were associated with delays to 12 flights, while false bomb threats affected aircraft and television channels. Sky News’s headquarters was evacuated. If coordinated, digital interference and physical precautions could reinforce each other by disrupting systems and forcing organizations to respond visibly. The source does not prove that they were coordinated.

Albares said there could be an “intento de agresión híbrida”. Other coverage mentioned a Russian shadow, but no perpetrator is confirmed in the supplied text. The immediate implication is a need to examine technical, operational, and influence-related evidence together rather than treating every incident separately.

The supplied article does not explain how European countries historically responded to suspected state-linked cyber or influence operations. Based on established public practice, governments have often begun with technical investigation, intelligence sharing, diplomatic protests, and public statements. They may later attribute an operation to a state when evidence is strong. Attribution can support coordinated political or economic measures.

Responses can include sanctions, expulsions of diplomats, criminal investigations, protective cyber measures, and cooperation with allies. Governments may also publish warnings to expose disinformation and reduce its impact. These tools are designed to impose costs and improve resilience while avoiding an immediate military confrontation. The exact mix depends on evidence, severity, and national policy.

That background helps explain why the reported threats would not automatically mean war. The source only says Albares saw a possible hybrid aggression and mentions a Russian shadow in headlines. It does not state that Russia was responsible, nor does it describe any sanctions, expulsions, diplomatic steps, or military decisions.