Hoax bombs on planes and hacked freezers: Europe's week of cheap disruption
At least 32 emailed bomb threats diverted or delayed flights across Europe in four days, then reached newsrooms in Ireland, Britain and Bulgaria. Hackers warmed supermarket freezers in seven countries. No government has said who is behind either.
On Monday 2nd November a Wizz Air flight from London Luton to Sofia received a bomb threat over Bosnia and Herzegovina. It turned back to Budapest, with a Hungarian Air Force fighter alongside, and was searched. Nothing was found.1
That was the first of at least 32 bomb threats against a dozen airlines in four days.2 None involved a real bomb. Each still cost a diversion, an evacuation or a search, and hours of delay, while whoever sent it took almost no risk.
Four days of threats
On Tuesday seven flights were targeted, including Ryanair planes searched at Rome's Fiumicino airport and a LOT flight from London that diverted to Warsaw-Modlin, which closed briefly. An Israel-bound cruise ship, the Crown Iris, was evacuated off the Greek island of Syros: 1,537 passengers and crew. The British government called them "malicious hoax threats".3
After a quiet Wednesday, the second wave on Thursday was bigger. Eurocontrol, which coordinates Europe's air traffic, counted 14 flights affected,4 and the BBC counted at least 21.5 An Aer Lingus flight from Dublin to Rome was diverted to a French air base in Normandy and its passengers evacuated. The email sent to Rome's airports that morning was signed by the "Fighters of the Male State" and threatened to "turn the skies red".5 On Friday the European Union's transport commissioner, Apostolos Tzitzikostas, counted 11 more flights.4
By Friday morning the threats had moved to newsrooms. At 8.33am an email titled "Message to the West" told RTÉ, Ireland's public broadcaster, that a bomb would go off within 45 minutes. RTÉ evacuated its Dublin headquarters and played pre-recorded programmes, and other Irish newsrooms were evacuated too.6 Sky in Britain and Nova TV in Bulgaria also received threats; the email was signed "Mikhail Andropov", and Reuters could not identify its sender.7
Freezers set to 50°C
At the same time, someone was reaching into Europe's supermarkets. A supermarket's fridges and freezers are run by small control boxes, many of them connected to the internet so that engineers can manage them remotely; where they are unpatched or keep their factory passwords, an intruder can change the temperature or switch them to defrost overnight.
The first wave hit France on the night of 11th–12th October, when fridges in hundreds of supermarkets were pushed to around 50°C.8 The second came on the night of 1st–2nd November, in seven European countries, including about 40 Delhaize stores in Belgium and Luxembourg.9 In Britain, three independent meat suppliers had units defrost or heat up, though they were empty and no meat was lost.10 In France, the national blood service said cold rooms holding plasma had been affected through a contractor, with no loss of blood products.11 On Thursday the FBI and four other American federal agencies warned grocers to take their refrigeration controls off the open internet.12
Who is doing it?
No government has said. The aviation threats have not been attributed to any group or state,4 and no formal attribution has been made for the freezer attacks.11 Ireland's government said the threats were "likely a coordinated campaign of disruption".13
The Male State, the name on the Rome email, is a Russian far-right, misogynist group that a Moscow court banned in 2021. A Telegram account linked to its founder told BBC Russian: "What Male State? Where have you seen it? It hasn't existed for many years."14 Russia's government has denied involvement.7
The pattern is familiar to European security officials. Western officials have said they suspect Russian military intelligence of earlier sabotage, such as the incendiary parcels that set fire to a DHL warehouse near Birmingham in July 2024,15 and the defining feature of such attacks is that they are cheap and hard to pin on anyone. This week's threats and hacks fit that description, but a fitting description is not evidence: the investigations have not yet established who is responsible, or whether the two campaigns are linked at all.
Where it stands
Police in several countries, and prosecutors in France and Belgium, are investigating. Airlines and air forces have treated every threat as potentially real, which is what makes a hoax effective. Until someone is identified, each new email will be handled the same way.