Who is behind Europe’s wave of bomb threats, cyberattacks?

A series of security incidents across Europe, including bomb threats at commercial flights, cyberattacks on supermarket refrigeration systems, and the evacuation of over 300 schools in Italy, has raised concerns about the continent's vulnerability to disruption without engaging in conventional warfare. On November 11, more than 300 schools in Italy were evacuated following an anonymous email warning of explosive devices.

Similar messages reached hundreds of schools in Scotland, Northern Ireland, and Ireland, prompting authorities to consider precautionary evacuations.

Italian Prime Minister Giorgia Meloni stated that preliminary security checks found no indication of a concrete danger. However, the scale of the warnings disrupted classrooms and families across the country, adding to a wave of incidents affecting European aviation and other civilian services. Earlier threats against Italian schools on October 19 and November 2 had also occurred.

Between November 3 and 5, multiple European flights faced diversions, escort by military aircraft, or security inspections after anonymous bomb warnings.

The incidents have sparked debate over whether they constitute part of a broader campaign of destabilization orchestrated by Russia, Iran, or other actors. Intelligence experts warn that while the coordinated distribution of threatening messages indicates a level of collaboration, it does not necessarily prove state involvement or the existence of a hybrid warfare campaign.

The central question remains whether the incidents demonstrate operational coordination among threat senders or strategic direction from a higher authority pursuing political objectives.

Experts suggest that relatively inexpensive threats can impose significant operational and economic costs. For instance, Aer Lingus diverted a flight from Dublin to Rome due to a bomb warning, while other flights involving Italy, Poland, Spain, Bulgaria, and various European capitals received security checks. Italian fighter jets were even scrambled to escort a Finnair aircraft traveling from Helsinki to Rome. Despite these disruptions, no confirmed explosive devices were found.

Some analysts argue that the limited technical sophistication of these threats might indicate involvement by smaller groups or domestic actors rather than sophisticated state intelligence or cyber units. However, the simplicity of the attacks could also be used to amplify fear, media attention, and pressure on authorities with minimal costs and operational risks. At this point, the origin and purpose of these incidents remain unresolved.