A wave of bomb threats disrupted more than a dozen European flights on Thursday, November 5, prompting diversions, aircraft searches and military interceptions across at least nine countries.
No explosive device or other hazardous material was reported during the inspections completed Thursday. Airlines and authorities nevertheless treated each warning as a potential threat, producing markedly different operational responses depending on an aircraft’s location, destination and phase of flight.
The incidents followed a separate cluster of threats earlier in the week. National investigations are underway, but European officials have not publicly established who sent the warnings or whether every message came from the same source.
Read our stories in your inbox
Two aviation newsletters. Zero fluff.
Aer Lingus A320 Diverts to French Air Base
The most significant diversion involved Aer Lingus flight EI402, an Airbus A320 operating from Dublin (DUB) to Rome Fiumicino (FCO). The aircraft diverted to Évreux air base (EVX) in Normandy after French authorities were notified of a bomb threat.
EI402 landed safely with 151 passengers and six crew members aboard. The occupants were taken to a secure area while military explosive-ordnance teams examined the aircraft. Aer Lingus described the diversion as a security precaution and began arranging onward travel for customers.
The flight’s use of a military airfield added complications that would not normally follow a diversion to a commercial airport. Passenger processing, ground transportation, baggage handling and replacement flying all had to be coordinated in an environment not configured for scheduled airline traffic.
The A320 is the principal short-haul type in the Aer Lingus fleet and is closely matched to sectors such as Dublin–Rome. Airbus lists the A320’s typical capacity at 150 to 180 passengers, with range well beyond that required for intra-European routes.
Finnair Flight Escorted Across Croatia and Italy
Finnair also confirmed alerts affecting two services from Helsinki (HEL): AY1761 to Rome and AY1471 to Vienna (VIE). Both aircraft reached their planned destinations, where passengers disembarked and security teams carried out inspections.
The Rome flight, an Airbus A320, received a military escort as it crossed southeastern Europe. In a detailed operational account, Croatia’s Ministry of Defense said a Croatian Air Force Dassault Rafale intercepted the aircraft at 8:41 a.m., seven minutes after it entered Croatian airspace.
The interception took place between Jastrebarsko and Karlovac. The Rafale accompanied the A320 toward the Italian boundary, where Italian quick-reaction aircraft assumed responsibility. The Finnair jet left Croatian airspace at 8:54 a.m. and continued to FCO.
Croatia said NATO’s Combined Air Operations Center at Torrejón authorized the response. The episode showed how an alert involving one scheduled flight can activate several national air-defense organizations as the aircraft crosses successive flight information regions.
AY1761 was carrying 144 passengers and seven crew members. AY1471, operated for Finnair by Jettime, had 177 passengers and six crew. Both threats proved unfounded. Finnair’s published fleet information includes the Airbus A320 among the narrowbody aircraft used on its European network.
Three Ryanair Flights Bound for Sofia Affected
Three Ryanair services to Sofia (SOF) were also subjected to threats. Flights from Madrid (MAD) and Copenhagen (CPH) continued to Sofia after their crews and authorities assessed the situation. A third aircraft, operating from London Stansted (STN), diverted to Plovdiv (PDV).
Security inspections found no threat aboard any of the three aircraft. Operations at Sofia and Plovdiv returned to normal after the checks, while Ryanair arranged ground transportation to Sofia for passengers who landed at Plovdiv.
The decision to split the response illustrates why apparently similar warnings do not always produce identical outcomes. An aircraft’s remaining flight time, fuel state, proximity to an appropriate airport and the facilities available on the ground all influence whether it continues, diverts or receives an escort.
Alerts Spread Across the European Network
Other airlines reported further warnings during the morning. LOT Polish Airlines flight LO235 from Warsaw (WAW) reached Brussels (BRU), where authorities inspected the aircraft without finding a dangerous item.
Wizz Air flight W46387 from Milan Malpensa (MXP) to Warsaw diverted to Vienna after Polish authorities received a threatening message. The aircraft was cleared after inspection and later continued to Warsaw. A second Wizz Air service, W43064 from Milan to Bucharest (OTP), landed in Bucharest and was searched with negative results.
Police at Prague (PRG) prepared for four arriving aircraft after receiving threats that explosive devices had been placed aboard them. Officers assessed the warnings as having low credibility but subjected all four aircraft to bomb-squad inspections. Nothing suspicious was found, and the Czech national counterterrorism and cybercrime unit took over the investigation.
Aegean Airlines said its A3552 service from Thessaloniki (SKG) to Milan and A3860 from Athens (ATH) to Vienna were also targeted. Both flights completed their sectors, underwent the required security procedures and were released after the threats were found to be baseless.
Standardized Rules, National Decisions
European aviation security is governed by a common regulatory structure, but decisions during a live event remain in the hands of airlines, police, air navigation providers and national security authorities. The European Commission’s aviation security framework sets common baseline requirements while allowing authorities to adapt measures to changing risks.
Threat assessment begins before a diversion is ordered. Specialists consider the specificity of the warning, the method by which it was delivered and any information that could indicate knowledge of the aircraft or flight. Even a warning judged unlikely to be credible can require a remote parking position, passenger evacuation, baggage reconciliation and a complete aircraft search.
Thursday’s events demonstrated the operational consequences of receiving similar threats across several jurisdictions at once. Each warning consumed police, airport, airline, air traffic control and, in several cases, military resources. Although the aircraft were ultimately cleared, the response could not be relaxed until the relevant authority had completed its assessment and inspection.
Bottom Line
The immediate safety outcome was positive: the aircraft landed without injury and searches did not uncover explosives. The wider concern is the imbalance between the effort needed to issue a remote threat and the resources required to disprove it. One message can remove an aircraft from service, disrupt crew rotations and trigger a response involving multiple airports and national agencies.
Airlines benefit from established threat-assessment and diversion procedures, while Thursday’s cross-border interceptions showed that NATO air-policing arrangements can follow a civil aircraft as it moves between national airspaces. The next test is investigative rather than operational: whether authorities can connect the messages, identify the communications infrastructure behind them and distinguish a coordinated campaign from copycat threats.
Until that work produces an attribution, the aviation sector is likely to maintain the same conservative response. For operators, the principal risk is not only another isolated diversion but a sustained series of alerts capable of tying up aircraft, crews, stands and security teams across several hubs at the same time.
