reuters.com - Bomb alert diverts airbus plane going dublin rome french pm says

A series of hoax bomb threats hit European airlines from Ireland ‌to Bulgaria on Thursday morning for the second time this week, with some of at least 25 affected flights making unplanned landings or escorted by fighter jets.
While no country has attributed blame for the threats, they come at a time when many European officials have accused Russia of masterminding sabotage and "hybrid attacks" — often cheap, easily deniable and not expected to trigger an armed response.

Airlines affected include Aer Lingus, Wizz Air, LOT, Finnair, Easyjet, Iberia
Flights destined for Prague, Paris, Rome, Brussels, Milan and elsewhere
European countries have previously accused Russia of hybrid attacks; Moscow denies any involvement
No direct blame for what was second wave of disruption after threats on Tuesday to seven planes, one cruise ship

There are two related but distinct categories worth separating here: cyberattacks affecting commercial refrigeration systems in supermarkets and attacks affecting refrigerated storage systems at blood banks and other medical facilities.

The important distinction is whether attackers actually compromised the refrigeration controls, disrupted temperature regulation, or merely attacked the IT systems responsible for monitoring and managing the equipment.

Confirmed and reported incidents: October–November 2026
A. France — October 11–13, 2026
First major reported wave
- Approximately 250–700 supermarkets were affected, depending on the reporting source and the date of the estimate.
- Retailers included Carrefour, Intermarché, Monoprix, E.Leclerc, and Coopérative U.
- Attackers remotely manipulated refrigeration controllers, changing temperature settings and activating defrost functions.
- Some stores lost substantial quantities of refrigerated and frozen merchandise.
- Both Danfoss and Dixell/Copeland equipment were reportedly affected.
- French cybersecurity authorities (ANSSI) investigated the incidents.
Sources:
An Assessment of Europe’s Refrigeration Attacks+1

B. France — November 1–3, 2026: Blood storage facilities
Medical infrastructure affected
- The Établissement Français du Sang (EFS) reported attacks affecting three of its facilities.
- The facilities' refrigerated storage chambers held blood products, plasma intended for transfusions, plasma used in pharmaceutical manufacturing, and biological samples.
- Attackers raised temperature and defrost thresholds to extremely high levels.
- The attack apparently came through a third-party refrigeration equipment provider, identified in subsequent reporting as Coolworld Rentals.
- Staff received alarms and transferred products to unaffected refrigeration facilities.
- No blood products were reported lost, and no health impact was identified.
- EFS said it was not directly targeted.
Sources:
The Guardian+2

C. November 2–3, 2026: Second European supermarket wave
This wave spread beyond France. The following countries have been identified in reporting:
Country Reported affected organizations or locations
Sweden ICA and Coop supermarkets
Belgium Delhaize, Carrefour and other retailers
Luxembourg Delhaize stores
Ireland SuperValu, 13 stores
Estonia Selver, at least one store
Netherlands Supermarket refrigeration incidents
Finland Retail refrigeration anomalies
Germany Supermarket refrigeration incidents
Italy Retail refrigeration incidents
Portugal Intermarché stores
United Kingdom Retail businesses

The reported effects included:
- Refrigerators and freezers being switched into defrost mode.
- Temperature settings being raised, in some instances to 50°C (122°F).
- Food products being discarded.
- Some refrigeration systems being shut down.
- Retailers temporarily removing chilled and frozen products from sale.
The specific number of affected stores varies by country, and not every reported incident has been independently confirmed as a malicious intrusion.

Sources:
The Guardian+3

2. What appears to connect the attacks?
There are several important commonalities:

The targets are operational technology (OT), not ordinary computer networks. The attackers are manipulating the equipment that physically controls refrigeration.

Remote management systems appear to be the point of entry. Supermarket and medical refrigeration systems increasingly permit outside technicians and suppliers to monitor and adjust equipment remotely.

Third-party suppliers may be a significant vulnerability. The blood-bank incident is particularly important because the intrusion reportedly reached EFS through its refrigeration contractor.

The attacks may be intended as sabotage rather than financial extortion. No ransom demands or publicly verified financial motives have been established for this series of incidents.

Attribution remains unresolved. Russian-aligned hacking groups have been discussed as possible suspects, but investigators have not established responsibility. There is no verified evidence tying all these incidents to one organization or government.
An Assessment of Europe’s Refrigeration Attacks+2

3. An important additional incident in the United States
In August 2026, refrigeration failures affected at least six U.S. military commissaries. The Pentagon subsequently investigated the possibility of cyberattacks. Iranian-linked actors were mentioned as a possible lead, but that attribution remains unconfirmed.

These incidents preceded the European attacks and should not automatically be assumed to be connected.
An Assessment of Europe’s Refrigeration Attacks+1

4. Principal reporting and technical sources
For further investigation, these are particularly useful:
1. The Guardian – French blood banks hacked in latest cyber-attack on Europe (November 4, 2026).
2. Reuters – New cyberattack on supermarket fridges sweeps across Europe (November 2, 2026).
3. BleepingComputer – Cyberattack disrupts blood storage refrigeration systems in France (November 4, 2026).
4. SentinelOne – Defrost and Disrupt: An Assessment of Europe's Refrigeration Attacks (November 3, 2026).

The blood-bank incident represents a significant escalation in the potential consequences of these attacks. Supermarket merchandise can be replaced, albeit at considerable expense. Compromising refrigeration systems holding blood, plasma, vaccines, biological specimens, or other temperature-sensitive medical supplies introduces a much more serious public-safety dimension.

One particularly important question for further investigation is whether the attackers compromised individual refrigeration controllers or gained access through a common refrigeration-management supplier. That distinction could determine how widely the vulnerability extends.

Foreign agitation and influence in recent European demonstrations
Foreign involvement is demonstrably present, particularly through social media, but the evidence does not support the conclusion that foreign governments are organizing or directing most of Europe's recent demonstrations.

The distinction is important. There is substantial evidence of foreign actors:
- Encouraging demonstrations already underway.
- Amplifying anger and hostility through coordinated social-media accounts.
- Circulating fabricated photographs, videos and reports of violence.
- Promoting extremist messages and calls for confrontation.
- Attempting to turn domestic grievances into opposition to European governments, NATO, and support for Ukraine.
There are also documented cases of people being paid to participate in staged demonstrations.

The most useful recent evidence comes from October and November 2026.
1. France and the October 2026 demonstrations
Documented foreign amplification
A particularly substantial investigation by Alliance4Europe examined the French demonstrations.

Its researchers analyzed:
- 547,471 social-media posts and news items.
- Six platforms: X, Telegram, TikTok, YouTube, Facebook and news sites.
- Nine languages.
- 12,839 comments under popular videos.
Their findings are revealing:
- They found no evidence that a foreign government originated the demonstrations.
- They identified Russian-linked networks actively amplifying the unrest.
- A network attributed with high confidence to Russia's Doppelgänger operation published 639 coordinated messages during the six weeks preceding October 17.
- Those messages received approximately 7.4 million views.
- The messages attempted to redirect French economic and political grievances toward opposition to French support for Ukraine.
This is not simply foreign commentary about French politics. It is coordinated information manipulation using real domestic grievances to advance foreign policy objectives.
Alliance4Europe

2. Germany — protests against military conscription
Russia-linked information networks have also been active around German demonstrations.

The protests concerned Germany's new military-service legislation and opposition to conscription.

A research report published October 8 by EK Strategies documented the following:
- Russian state-controlled RT DE promoted a school strike against conscription scheduled for May 8.
- The strike was advertised in 79 German cities.
- Russian information channels subsequently promoted another nationwide mobilization on September 25.
- Russian media interviewed demonstrators in Berlin on October 3, and Russian-linked channels redistributed those interviews.
- The messaging repeatedly portrayed the German government as preparing for war with Russia at the expense of its own population.
Importantly, the original demonstrations were organized by German groups. The foreign involvement consisted of promotion, political framing and amplification, rather than proven creation of the movement.
EK Strategic Communications Center

3. Poland — actual paid demonstrators
Documented physical involvement
This is a particularly significant case because it goes beyond social media.

On July 2, 2026, the Ukrainian Security Service (SBU), working with Polish law enforcement, announced that it had identified 11 people involved in organizing Russian-directed, anti-Ukrainian demonstrations.

According to the investigation:
- Five staged demonstrations took place in Warsaw and Wrocław during 2025–2026.
- Participants were reportedly offered $100–$200 for appearing in the crowds.
- Eleven organizers were identified, including nine Ukrainian nationals and two Belarusians.
- The organizers reportedly received instructions from Moscow-based coordinators.
- They recruited participants, distributed provocative materials and paid them.
The stated purpose was to discredit Ukraine and destabilize European societies.

This is an official security-service allegation resulting from a joint investigation, rather than a judicial finding establishing the guilt of every person identified. Nevertheless, it is concrete evidence of an actual foreign-directed street operation.
SSU

4. Spain, France, Italy, Portugal and other countries — fabricated demonstrations
Another increasingly important technique is the creation of entirely fictional demonstrations.

In September, Euronews investigated AI-generated videos circulating on TikTok.

The videos purported to show enormous demonstrations in:
- Portugal
- France
- Germany
- Ireland
- Italy
- United Kingdom
Some attracted more than 300,000 views.

The demonstrations depicted in those particular videos had never happened. Some videos impersonated television journalists and established news organizations.

Their apparent purpose was to create the impression that anti-immigration and nationalist movements were much larger and more widespread than they actually were.

This is significant because it can create a feedback loop: people see what appears to be a mass movement, believe others are participating, and become more inclined to join a real demonstration.
Euronews

5. Which foreign countries are involved?
The evidence varies considerably by country and type of activity.
Foreign actor Documented or reported activity
Russia Most extensively documented involvement: Doppelgänger networks, RT, coordinated social-media accounts, paid demonstrators and anti-Ukraine messaging.
Iran Coordinated networks have manipulated European news comment sections, including campaigns promoting inflammatory religious and political messages.
China Identified by French officials as a source of hostile information narratives, although direct involvement in organizing the recent demonstrations has not been established.
Belarus Individuals were identified in the Russian-directed paid demonstration investigation in Poland.
Foreign political influencers Some American and other foreign political personalities have amplified misleading accounts of European unrest. This does not necessarily indicate government direction.

A particularly interesting investigation by the European Broadcasting Union, published July 9, 2026, identified coordinated manipulation across 17.5 million comments on European public broadcasters' social-media accounts. Iran-related political activity was a major subject of the investigation. Some networks involved automated accounts operating alongside genuine political supporters.
spotlight.ebu.ch

6. How prevalent is it really?
I would assess the evidence in three separate categories:
Type of foreign involvement Assessment
Foreign amplification of existing demonstrations Substantial and documented
Coordinated disinformation and fabricated imagery Substantial and documented
Foreign agents organizing or financing actual demonstrations Documented, but relatively few publicly established cases
Foreign governments originating and directing widespread European unrest Not established

There is an important qualification.

On October 21, Euronews reported that French and Italian officials were blaming foreign actors for exploiting the unrest, but the European Commission said it had not received conclusive evidence that foreign information manipulation caused the demonstrations.

French President Macron similarly distinguished between foreign interference in the demonstrations themselves, for which he said there was no evidence, and foreign manipulation of information afterward, which he acknowledged.
Euronews

7. Overall assessment
I think there are three developments worth watching particularly closely.

First: The deliberate exploitation of legitimate grievances.

Foreign actors do not need to invent dissatisfaction with immigration, economic conditions, military conscription, taxation or government policies. They can exploit dissatisfaction that already exists, amplify the most divisive aspects, and encourage people to regard their own government as illegitimate or incompetent.

Second: The creation of an artificial impression of popular support.

Coordinated accounts, AI-generated videos, fabricated news reports and paid participants can make a relatively small movement appear much larger and more widespread. That can influence both public opinion and the behavior of legitimate political organizations.

Third: The relationship between online agitation and physical disruption.

The Polish case demonstrates that foreign operations can extend beyond online propaganda into recruiting and paying people to participate in demonstrations. The extent to which this is happening elsewhere remains unclear.

One final distinction is essential: Foreign amplification does not mean that demonstrators are foreign agents, that their grievances are illegitimate, or that their demonstrations are somehow manufactured. Genuine domestic movements and foreign influence operations can coexist.

So, the challenge is, how do you retaliate against a country which denies responsibility and ensure that the attack was not done by an agent provocateur trying to elicit that response. At what level is the response, even if attributable, proportional and appropriate or will it be taken as a new escalation? Will the US drop any semblance of support if the European entity is accused of starting an escalated attack? Do you call in fake bomb threats in Russia? Do you, in the absence of internet-connected refrigerators, maybe mess with their water supply or heaters? As long as there are no bread crumbs left behind, well, it could be almost anyone - right?

Jeff

How frightened should Europe (and the US) be