No bombs found, but the alarm went off 27 times

Baltic Security Monitor | Material Update · 5 November 2026, 20:00 EET

On 5 November Europe saw its second wave of bomb threats against passenger flights in a single week. By Reuters' count, at least 27 flights were targeted, more than three times as many as on 3 November. Aircraft were diverted, searched on landing, and several were escorted by fighter jets. No explosives were found and no perpetrator has been identified. The same day, Sweden extended its border controls, explicitly citing hybrid threats linked to Russia's war, and the EU transferred €4.36 billion to Ukraine.

The second wave: from Warsaw to Rome

On 3 November at least seven flights received threats, including two aircraft bound for Warsaw; both landed safely. On 5 November the wave was far wider. Reuters counted at least 27 flights; other outlets give lower figures, reflecting different counting methods.

Among the reported incidents:

• France. An Aer Lingus Dublin–Rome flight was diverted to the Évreux military air base.
• Italy. A Finnair Helsinki–Rome flight was escorted by a fighter jet and inspected on arrival. Several Ryanair and Aegean flights landed in Milan.
• Austria. Wizz Air and Finnair/Jettime flights were diverted to Vienna.
• Poland, Belgium, Romania. A LOT aircraft landed in Brussels, and a Wizz Air flight to Bucharest was also targeted.
• Bulgaria. Three Ryanair flights made emergency landings.
• Czech Republic. Police confirmed threats against four Prague-bound aircraft. They were judged low-credibility, but explosives checks were carried out.

Incidents were also reported on flights linked to Ireland, Greece, Portugal, Spain and Denmark. Some threats reached airlines by email; how the rest were delivered has not been confirmed. No one has claimed responsibility, and no government has formally blamed anyone. 🟡 Whether the waves were coordinated, and by whom, is unknown.

BSM analysis

Aviation security expert Paul Mason told the BBC that the scale and credibility of the threats pointed to "a very deliberate act." Threats against passenger aircraft in Europe are usually isolated; this week there were more than thirty.

The main effect of a false alarm is not fear but cost. Every threat triggers the full chain: rerouting, landing at an alternate airport, evacuation, inspection and, sometimes, scrambling fighters. It is the same kind of load the Baltic states and Poland face from drones on their borders: cheap for whoever creates it, expensive for whoever has to respond.

Resemblance to a hybrid operation is not proof, though. Mass hoax threats have in the past come from criminal groups and lone individuals. Without shared technical traces — sender addresses, message templates, infrastructure — linking the wave to Russia or any other state would be premature.

Sweden: border controls for another six months

On 5 November the Swedish government decided to reinstate controls at Schengen internal borders from 12 November 2026 to 11 May 2027. The main justification is the security situation created by Russia's full-scale invasion of Ukraine: hybrid threats and hostile actors moving and operating within the Schengen area. The government assesses this as a serious threat to public order and internal security. The police will decide where and how checks are carried out. France, Germany, Norway and Denmark have also reintroduced internal controls.

BSM analysis

The decision itself is routine: Sweden renews its controls every six months. What is new is the wording. Stockholm now explicitly justifies measures at the EU's internal borders by hybrid activity linked to Russia's war. For the north-eastern flank, it is another sign that the threat is no longer seen only at the external frontier, but as something operating inside Schengen.

EU: €4.36 billion for Ukraine, €658 million of it for defence

The European Commission disbursed €4.36 billion to Ukraine from the €90 billion Ukraine Support Loan. €3.7 billion is the second 2026 instalment of macro-financial budget support; Ukraine met all 12 conditions, including taxing digital-platform income, ending the VAT exemption on low-value parcels and modernising customs. Another €658 million is the seventh defence payment, for drones, missiles, radars, electronic warfare and air-defence ammunition, mostly from Ukrainian manufacturers. Defence payments under the instrument now total €16.4 billion, with about €25.2 billion still available for 2026.

Unlike the packages still being prepared, this is money actually transferred. (More on the Italian package and 2027 financing: Security Watch, 5 November 14:00 and 08:00.)

Monitoring: open investigations

• Latvia. No wreckage found in Balvi district; attribution remains preliminary.
• Poland. The security operation near the Kaliningrad border continues until at least 8 November.
• Ryazan refinery. Damaged units and impact on throughput not confirmed.
• Germany. The finance ministry has proposed an extra €100 million for Ukraine's water, energy and transport infrastructure. 🟡 A proposal, not an approved decision.
• Refrigeration cyberattacks. No common attack vector or attribution.

Conclusion

In a single day Europe showed three different responses to the same reality. Aviation treated every threat as real. Sweden extended its border checks, naming hybrid threats outright. The EU sent Ukraine money, part of which will go on drones and air defence. Who is behind the threats to aircraft is still unknown, but the cost of responding is already real.

A false alarm destroys nothing. It just makes everyone behave as if destruction were close.

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security across NATO's north-eastern flank.
Prepared from open-source monitoring; the verification status of each fact is marked in the text.