Bomb Threat Wave Disrupts European Flights: LOT, Ryanair and SAS Face Mass Security Alerts

The most disruptive incident involved LOT flight LO286, a Boeing 737 MAX 8 travelling from London Heathrow to Warsaw with 181 people on board.

A security warning was received at 8:54 am GMT. Rather than continue to Warsaw Chopin Airport, the aircraft was diverted to Warsaw-Modlin, where it landed safely at 10:01 am.

The airport was temporarily closed while the aircraft was moved to an isolated area. Bomb disposal specialists and security personnel examined the plane and passengers' luggage. Travellers waited in the arrivals lounge until the checks were completed, after which the airport resumed operations.

Another Warsaw-bound flight was also affected. SAS flight SK751, travelling from Copenhagen, received a bomb threat while airborne. The captain informed passengers, and the aircraft landed safely at Chopin Airport, where specialist security teams carried out inspections.

SAS communications director Alexandra Lindgren Caukji confirmed both the warning and the safe landing.

In Spain, Ryanair flight FR4116 from Manchester to Murcia landed safely at 10:50 am local time after a security alert. The aircraft was carrying 114 passengers and seven crew members. Passengers were evacuated, and Civil Guard bomb disposal specialists, known as TEDAX, inspected the plane.

Bulgarian counter-terrorism officers were meanwhile deployed to Sofia Airport after a flight originating in Israel received a bomb threat by email.

Each incident required an immediate response from authorities who could not know in advance whether the warning was credible.

That uncertainty is central to the problem.

A bomb threat received during a flight cannot simply be dismissed because it is anonymous or resembles a previous hoax. Security procedures are designed to protect passengers against potentially catastrophic consequences, even when the available information is incomplete.

The result is an unavoidable imbalance. Issuing a warning may require little effort, while investigating it can involve pilots, airport operators, police, specialist disposal teams and air traffic authorities.

Why False Alarms Can Cause Real Damage

European airlines operate within closely connected schedules. Aircraft arriving at one airport may be expected to depart on another route shortly afterwards, sometimes with limited time between flights.

A diversion therefore affects more than the passengers on the original service.

Aircraft and crews can end up in the wrong location. Ground-handling arrangements must be changed, onward flights may be delayed, and airport operators must accommodate unexpected arrivals while maintaining their existing schedules.

For low-cost carriers operating with tight turnaround times, these disruptions are particularly difficult to absorb.

The closure of Warsaw-Modlin illustrates the wider consequences. A single aircraft requiring security isolation can interrupt an airport's normal operations, even when the aircraft itself has landed without difficulty.

There are financial consequences too. Airlines face additional operating costs, while airports must manage emergency deployments, interruptions and the expense of maintaining specialist security capabilities. Repeated incidents could also increase insurance costs.

The effects are not limited to immediate expenditure. Passengers who encounter repeated security alerts may become more anxious about flying, particularly when threats emerge across several countries within a short period.

European aviation depends on predictability. Security warnings exploit precisely that dependence.

The question is not whether authorities should respond to an unverified bomb threat. They must. It is how often the system can sustain such interventions before the cumulative disruption becomes a serious operational burden.

The Hybrid Warfare Question

Tuesday's events occurred against a European security backdrop that has changed substantially since Russia's full-scale invasion of Ukraine in 2022.

Governments have reported cyber-attacks, suspected hybrid operations and threats to critical infrastructure. Transport networks are increasingly considered potential targets because disruption can spread far beyond the immediate location of an incident.

One particularly serious case emerged in August, when an explosive-laden drone was discovered near an Antonov cargo aircraft at Leipzig/Halle Airport in Germany.

German authorities attributed that incident to Russia and described it as a new hybrid threat scenario. EU foreign policy chief Kaja Kallas called it "state terrorism", while NATO Secretary General Mark Rutte pledged stronger defensive measures.

The Leipzig case differs fundamentally from Tuesday's aviation alerts.

It involved a physical device carrying explosives and an official attribution by German authorities. The latest bomb scares, by contrast, have produced no officially reported explosive discoveries, and investigators have identified no responsible organisation or state.

There is no established evidence connecting the incidents.

Nor is there confirmation that the four Tuesday threats originated from the same source. The email warning reported in the Sofia case does not establish how the other alerts were transmitted.

These distinctions matter. A series of threats occurring on the same day may invite suspicion, but timing alone cannot establish coordination or state involvement.

What the incidents do reveal is how easily methods associated with psychological pressure and operational disruption can affect civilian aviation.

A hostile actor seeking to test emergency response times or exhaust security resources would not necessarily need to damage an aircraft. Repeated warnings could compel authorities to deploy personnel, suspend operations and investigate potential dangers.

That possibility is relevant to Europe's wider discussion of hybrid warfare. It is not, however, proof that Tuesday's incidents formed part of such a campaign.

Aviation Security Is Becoming an Infrastructure Defence Problem

Traditional aviation security has concentrated heavily on preventing dangerous objects and individuals from reaching aircraft.

Passenger screening, baggage inspections and access controls remain essential. But threats involving drones, cyber systems and remote communications present challenges that cannot be addressed solely at airport checkpoints.

The distinction is increasingly important for European security planners.

An airport may have effective boarding controls and still face disruption from an anonymous warning, an unmanned aircraft or interference with surrounding infrastructure.

The growing attention to drone activity illustrates the changing environment. In the year leading up to August 2026, 340 drone-related security incidents were recorded near UK Ministry of Defence sites, compared with 126 in 2024.

Those figures concern military facilities rather than commercial aviation. They nevertheless provide context for the broader concern about protecting sensitive infrastructure against threats that do not depend on conventional physical access.

European aviation security already involves national authorities and EU institutions, including the European Union Aviation Safety Agency (EASA). NATO's wider counter-hybrid commitments add another dimension to the discussion.

The challenge is to improve cooperation without confusing different responsibilities.

Civil aviation authorities must maintain safe flight operations. Police and counter-terrorism services investigate threats. Intelligence agencies assess possible hostile activity, while defence organisations increasingly consider the protection of infrastructure against drones and other unconventional threats.

Better intelligence sharing, cyber-security protection, counter-drone capabilities and rapid aircraft isolation procedures are among the measures relevant to this changing environment.

They also carry costs.

Security and defence contractors stand to benefit from growing demand for electronic warfare equipment, anti-drone systems and infrastructure protection technology. Intelligence and counter-terrorism agencies may gain greater prominence in national security planning.

Airlines and airport operators, meanwhile, must contend with the expense of adapting to threats whose frequency and origin are difficult to predict.

The Limits of a Security Response

The immediate priority in Poland, Spain and Bulgaria was straightforward: land the aircraft safely, protect passengers and determine whether explosives were present.

Those procedures worked in the sense that the flights landed without reported casualties and specialist teams were deployed.

But successful emergency intervention does not necessarily prevent the disruption that a threat has already caused.

This creates a difficult problem for aviation authorities. Relaxing their response to repeated warnings could expose passengers to unacceptable risks. Maintaining maximum precautions for every alert allows even an unverified message to impose substantial costs.

The difficulty becomes greater when incidents occur across national borders.

Tuesday's threats affected aircraft travelling between Britain, Poland, Denmark, Spain, Israel and Bulgaria. Their routes crossed different jurisdictions, while the immediate security response remained the responsibility of national authorities.

Determining whether such incidents share a source requires information that may be held by several airlines, airports and investigative agencies.

Even if all the latest warnings prove false, the operational consequences will have been real.

The longer-term concern is whether European aviation can develop ways to distinguish and manage recurring threats more efficiently without weakening its safety standards.