Bomb hoaxes, infrastructure arson and cyber threats expose different weaknesses in European resilience. Their operational costs justify stronger protection and cooperation, not an assumption that every incident belongs to one state-directed campaign.
Europe’s civilian disruption burden is widening, but attribution remains incident-specific
Reporting evidence through .
Europe faces a widening civilian-security burden that does not require successful physical attacks to impose costs. Reporting through 7 November 2026 established that bomb threats had spread from passenger aviation to broadcasters in Ireland, Bulgaria and the United Kingdom. On 6 November, aviation responses included Hungarian fighter escorts and French aircraft inspections; RTÉ evacuated its Dublin headquarters before resuming operations after a police search. These incidents show how precautionary responses can consume security capacity across borders and sectors even when no explosive device is found.26
Spain’s foreign minister described the incidents as possible hybrid aggression. European officials place the threats in the context of a wider disruption campaign often attributed to Russia, which denies involvement. That makes a coordinated, state-backed campaign a relevant hypothesis, but responsibility remains incident-specific. Poland’s October attribution of September arson at a Starlink station to Russian intelligence concerns a damaged facility supporting data routes toward Ukraine; July UK-EU cyber attribution concerns separate activity. Neither establishes responsibility for November’s threats. Their senders and links remained unidentified, while copycats and false trails offer plausible alternatives. Even evidence linking the hoaxes would still require separate evidence of state direction.572
The practical priority is therefore resilience alongside investigation: protecting communications power supplies, sustaining civilian operations during searches and improving cyber defences. NATO provides a standing framework, while EU consultation proposals and Joint Expeditionary Force planning illustrate efforts to strengthen coordination. Their last reported status does not establish subsequent implementation or new deployments. The strategic assessment would change most with verified links between incidents, stronger attribution evidence or sustained service failures—not simply more threatening messages.95814
A review reassesses the linked evidence; it does not reverify every underlying source.
Material developments
What has changed
Briefing evidence ·
Hoaxes extend the cross-sector response burden
Threats on 6 November widened the immediate security burden across both aviation and broadcasting. Hungary escorted three aircraft, France reported four aircraft threats and Czech authorities recorded nine Prague-linked flights; these figures describe different national exposures and should not be added into a unique incident total. Broadcaster responses ranged from RTÉ’s evacuation to NOVA’s safety procedures without interrupted broadcasts. The material change is broader civilian exposure, not demonstrated coordination or a verified explosive threat.62
Briefing evidence ·
Poland elevates the Starlink arson case to alleged state-directed sabotage
By 13 October, Poland had publicly attributed the 23 September Starlink-station arson in Wola Krobowska to Russian intelligence, and two Turkish nationals had been arrested in Germany at Poland’s request. The development added an official state-direction allegation and cross-border enforcement dimension to the earlier fire. Damage to the power system and backup generator also highlighted the physical dependencies of communications infrastructure supporting Ukraine; the underlying attribution intelligence was not publicly detailed.5
How we got here
The history behind the risk
National responsibility within an allied framework
NATO’s January 2026 account describes hybrid methods as combining overt and covert, military and non-military activity. Since 2016, the alliance has said hybrid actions could lead allies to consider Article 5; leaders agreed counter-hybrid support teams in 2018 and broader preventive and response options in 2022. First responsibility remains with the targeted country. This creates a layered response structure: national investigation and protection come first, with allied assistance and potential collective consideration rather than an automatic military response to every disruption.9
Cyber defence expands beyond individual attackers
On 13 July 2026, the UK and EU coordinated cyber sanctions, listing 24 people and entities in the UK and nine individuals and four entities in the EU. Their targets included alleged operators, hosting infrastructure and enabling networks. They also attributed a failed December 2025 attack on Poland’s energy grid to Russia’s FSB Centre 16; no outage was reported. Accompanying technical guidance focused on routers and network-management controls. The episode illustrates the combination of diplomatic attribution, financial restrictions and operator-level protection, rather than proof that sanctions disabled the networks.37
Consultation, cyber preparedness and northern cooperation
Coordination initiatives broadened in September and early October. On 16 September, Commission President Ursula von der Leyen proposed member-state-triggered EU consultations for incidents below armed aggression; the report established a proposal, not an operational mechanism. On 24 September, seven Dutch bodies warned that accessible AI could accelerate vulnerability discovery and exploitation, without documenting an active incident. JEF ministers meeting at Keflavik on 2 October advanced Ukrainian participation and alignment with NATO regional plans across the North Atlantic, High North and Baltic approaches. Their statement set planning direction without public force or resource commitments.184
Economic transmission
How the effects could spread
Conditional mechanisms, consolidated across the evidence. They are not predictions of asset returns.
Who is exposed Airlines, airports, air-navigation providers and broadcasters.
A threatening message can trigger escorts, inspections, evacuation and searches, consuming security resources and interrupting operations without a physical attack.62
Depends on
Repeated threats must continue to require operational responses; wider economic effects would depend on their frequency, duration and reach.
What could offset it
No devices were found in the reported aviation incidents, affected flights landed safely and broadcaster continuity varied, limiting the demonstrated impact.
Evidence basis ·
Physical power dependencies transmit communications disruption
Who is exposed Communications infrastructure and institutions relying on data routes through Poland toward Ukraine.
The September Starlink-station fire damaged both the power system and backup generator, with reported disruption to institutional connectivity. It illustrates how damage to supporting equipment can impair communications without destroying the station.5
Depends on
Comparable disruption would require damage that exceeds the protection, redundancy or restoration capacity of the affected site.
What could offset it
The station was not destroyed. The September episode does not establish continuing connectivity disruption or failure across other facilities.
What would change our view
Signals to watch
Forensic links between threatening messages
Evidence to monitor
The November reporting did not establish a common sender or a connection between aviation and broadcaster threats. Check for investigative findings linking senders, message infrastructure or targeting patterns.
Why it matters Verified links would strengthen the coordinated-campaign interpretation; state attribution would still require separate evidence.26
Duration and scale of civilian interruption
Evidence to monitor
Affected aircraft landed safely, RTÉ resumed operations after a search and NOVA maintained broadcasts. Check for documented prolonged closures, repeated diversions or sustained broadcasting interruptions.
Why it matters Persistent service loss would indicate a more consequential operational burden than the precautionary responses established so far.26
Evidence emerging from the Starlink investigation
Evidence to monitor
Two suspects were arrested in Germany, while Poland’s attribution intelligence remained undisclosed. Check for charges, judicial findings or publicly documented evidence connecting suspects to direction of the arson.
Why it matters Such findings could strengthen or narrow the state-directed sabotage assessment and clarify the cross-border enforcement case.5
Concrete implementation of coordination plans
Evidence to monitor
The last reports described an EU consultation proposal and JEF follow-on planning without public implementation timelines or force commitments. Check for adopted activation rules, funded measures or specified operational tasks.
Why it matters Concrete implementation would support a stronger assessment of response capacity than political agreement and planning alone.14
Sources & evidence
Numbered links show the evidence supporting each passage. Published briefings retain their original sources and dates.
Bomb threats reached broadcasters in Ireland, Bulgaria and the United Kingdom on 6 November after a week of aviation hoaxes, prompting precautionary measures while the sender, links between incidents and any state involvement remain unverified.
Bomb threats against passenger flights on 6 November prompted fighter-jet escorts and aircraft inspections across several European states, but no devices were found and authorities had not identified a responsible actor.
Poland says Russian intelligence directed the September arson at a Starlink station serving data routes toward Ukraine, while two suspects arrested in Germany face investigation.
The United Kingdom’s 1 October Russia sanctions package remains in force, targeting LNG-linked vessels, alleged disinformation networks and people accused by London of abuses in occupied Ukraine, while preserving limited Sakhalin-2 licensing.
As of 4 October 2026, Joint Expeditionary Force defence ministers have set implementation work to deepen Ukraine’s participation, align JEF response options with NATO regional plans and strengthen preparedness for alleged Russian hybrid activity, without announcing a deployment or new security guarantee.
Seven Dutch security and government bodies warned on 24 September that widely accessible AI is speeding cyberattack preparation and called on public- and private-sector leaders to strengthen baseline defences and oversight.
As of 24 September, NATO says European allies and Canada are assuming a larger role in continental defence while the United States retains critical but more limited capabilities.
European Commission President Ursula von der Leyen has proposed a member-state-triggered EU consultation mechanism for drone incidents, sabotage and cyberattacks, but no legal text, decision rules or implementation timetable has been set out.
UK and EU sanctions imposed on 13 July remain in force against Russian cyber and hybrid-threat actors, combining designations with a joint attribution of disruptive operations against Polish critical infrastructure to Russia’s FSB Centre 16.
The EU and UK have simultaneously sanctioned Russia-linked cyber actors, combining financial and travel restrictions with an official attribution of a failed attack on Poland’s energy grid to Russia’s FSB Centre 16.
The European Union and United Kingdom have imposed coordinated cyber-related sanctions on Russia-linked individuals and entities, coupling economic restrictions with an official attribution of a failed attack on Poland’s energy grid to Russia’s FSB Centre 16.
As of 14 July 2026, the European Union has imposed restrictive measures on nine individuals and four entities after attributing cyberespionage and sabotage activity affecting member states and partners to Russia’s FSB-linked 16th Centre and associated actors.
The EU and United Kingdom have imposed coordinated sanctions on Russian cyber and hybrid-threat actors while publicly attributing a failed December 2025 attempt to target Poland’s electricity grid to the FSB’s Centre 16.
The UK and EU have imposed coordinated sanctions and formally attributed a failed December 2025 cyberattack on Poland’s energy grid to Russia’s FSB Centre 16, alongside new defensive guidance for critical-infrastructure operators.
