Hoax bomb threats have disrupted dozens of passenger flights across Europe, forcing unplanned landings by some planes and prompting fighter jets to escort or intercept others, in a dramatic escalation after an initial wave earlier this week.
The highly unusual spate of bomb threats affected almost 30 flights by the end of Thursday, after at least seven flights and a cruise ship also received hoax threats on Tuesday.
No government has said who was behind the threats, and no claim of responsibility has been verified.
Security experts said it could be individuals acting on personal grievances or copycats, but also that it had the hallmarks of a more coordinated "hybrid attack".
"When it comes to a situation like this or even other sabotage attacks, it's really hard to prove there's a certain country behind it. But it does fit in the modus operandi," said Eric Schouten, head of aviation security group Dyami.
Many European officials have accused Russia of masterminding sabotage and hybrid attacks since its 2022 invasion of Ukraine. These are often inexpensive to carry out, easily deniable and not expected to trigger an armed response.
Denmark, Poland and Romania, all affected by Thursday's disruptions, have previously accused Moscow directly of being behind hybrid attacks, while Germany blamed Russia for an August attack on Leipzig airport. Britain, which has in the past blamed Russia, linked Iran to a suspected plot against a US air base.
Both Russia and Iran have denied those accusations.
An airport source in Italy told Reuters that an email with the subject line "Threat report" had been sent to several addresses for airlines, airport operators and airport service providers at Rome's Fiumicino and Milan's Malpensa airports.
The email, which claimed it was from "Fighters of the Male State", said devices had been placed on inbound flights from Helsinki and Dublin and they would explode in one hour.
"Today your sky will be red," it said.
Reuters could not independently confirm who had sent the email and there was no immediate indication of who was behind the other threats across Europe.
In France, Prime Minister Sebastien Lecornu's office said he had sent fighter jets to intercept an Aer Lingus flight from Dublin to Rome and escort it to an air force base at Evreux after the pilot did not cooperate with authorities as expected.
Lecornu's office gave no reason for the pilot's behaviour.
Bulgaria's air force said its fighter jets had escorted three airliners to the ground. One Ryanair flight from London to Sofia was diverted to Plovdiv, Bulgaria's second city. Romania's intelligence agency said a KLM flight to Tel Aviv with a layover in Bucharest had received a bomb threat.
Spanish police said three emailed threats came in within 20 minutes involving two Air Europa departures from Madrid to Paris and four inbound Iberia flights from Rome and Milan. Several aircraft were halted or returned to their stands in Madrid and passengers disembarked as the aircraft were inspected.
In Warsaw, a LOT flight to Paris was stopped as it taxied towards take-off and passengers were transferred to another plane, while Danish police said two planes were searched at Copenhagen airport.
Other flights that received threats, including EasyJet, Finnair, LOT, Wizz Air, Ryanair and Air Serbia services to Prague, Sofia, Vienna, Brussels, Bucharest, Rome and Milan, landed as scheduled, some after military escorts.
Eliran Almog, CEO of aviation cybersecurity firm Cyviation, said the hoaxes could serve both to disrupt operations and to observe how airlines, airports and authorities respond.
"These aviation threats are also occurring in the same period as cyberattacks on supermarket refrigeration systems across Europe," Almog said.
"Different essential services are experiencing disruption that carries economic costs and can undermine public confidence."
This week, unidentified hackers for the second time shut down fridges in supermarkets in several European countries, also affecting French blood banks.
