Hoax bomb threats diverted at least 25 commercial flights across Europe yesterday, with some forced to make emergency landings, following similar threats on Tuesday when seven planes were searched or diverted. In a separate escalation, cyber attacks targeted supermarket fridges in Belgium, Sweden, the UK, and cold storage facilities of France's national blood service.
The actors behind this week of disruption—whether hostile states, criminal gangs, or teenagers—remain unidentified. However, they operate in a context of deepening global conflicts and a pervasive sense of vulnerability, according to the Guardian's defence and security editor, Dan Sabbagh.
Investigations and Context
Investigators have found no suggestion of orchestration by a hostile terror group or state actor, though investigations continue. Aviation experts told the Guardian that airlines treating these threats as credible suggests potential coordination. Dan notes that airlines receive bomb threats daily at a rate that would be extraordinary if known.
The threats come amid heightened aviation security scrutiny after the flydubai incident, when a pilot fought off a knife-wielding colleague in an apparent attempt to crash a flight heading to Tel Aviv.
Hybrid Warfare and Cyber Tactics
Conflicts in Ukraine and the Middle East are reverberating closer to home. Since 2022, European states have witnessed intensifying acts of sabotage believed to trace back to Russia but deliberately falling below the threshold for military response—a so-called hybrid or "shadow war" aimed at disrupting support for Ukraine. Two months ago, an alleged attack plot on RAF Fairford was organised by a handler police believe was working on behalf of Iran.
Tech expert Azeem Azhar warned that the internet is experiencing its own "Wuhan moment," as AI enables bad actors to hunt for system flaws and spread them, mirroring the early days of the Covid pandemic. "Terrorism doesn't have to be violent to terrorise," says Dan. "The purpose of terrorism is to scare."
Targeting Infrastructure
Supermarket fridges and freezers in seven European countries malfunctioned earlier this week, with thermostats remotely cranked up in some cases to 50C. Similar incidents were reported in the UK. One cybersecurity researcher told Dan that attacks on dummy Danfoss fridge controls—one of the software systems targeted in mainland Europe—had "all the hallmarks" of operations linked to Russia.
"There are only ever two likely candidates for a hack," Dan says. "Criminal gangs or nation states." He adds an emerging tertiary category of "troublesome teenagers," such as the loose collective of English-speaking hackers Scattered Spider, two of whom were jailed in July for their attack on Transport for London.
Security Response and Resilience
"There is a very real and intense cyberwar going on out there," Dan says. Security agencies in the UK have viewed technological resilience as a key responsibility for years. The Turing Institute is looking at ways to utilise AI to make critical infrastructure systems more secure.
MI5 has about 3,000 active subjects of interest currently, arranged in a hierarchy with a focus on the more serious threats, including threats to life. Lower-level activity that is not obviously threatening can be harder to pick up, a resourcing question as much as anything else.
Global technology reporter Aisha Down explains that many hacks happen through edge devices—networked items connected to the internet without processing power, which are not the main focus of security upgrades. She notes that every cyber-attack is opportunistic: a hacker has to find a vulnerability and then discover a way to exploit it. "Just like a burglary, you might get into the room where all the jewellery is stored," she says, "but the damage you can do is not a given."
Finland, given its proximity to Russia, is watching cyber-tactics closely. Reports to its national cybersecurity centre grew from 18,000 last year to 21,000 this year, for a population of 6 million people. This can be partly traced to a developing criminal hacking ecosystem, some with loose links to the Russian state.
The UK government's Be Ready initiative advises citizens to offset threats of hybrid warfare by stockpiling 72 hours' worth of emergency supplies, including water and non-perishable food. Governments across Europe are advising citizens to build up non-perishable larders.
One European cybersecurity official told Aisha that there's a vulnerability in every 1,500 lines of code on average. "Their view is: it's going to happen. It's going to be opportunistic. But, unlike bombing a power station in the dead of winter, you won't be offline for months."
As Dan puts it: "If the purpose of terrorism is to generate fear, the first thing you should do is not panic and keep calm."
