Hoax flight threats and fridge hacks expose Europe's 'grey zone' risks

Hoax bomb threats forced at least 25 commercial flights across Europe to divert or make emergency landings on Thursday, capping a week in which cyber-attacks also disrupted supermarket refrigeration systems and the cold storage facilities of France's national blood service.

Investigators have not identified who is responsible. In its Friday briefing, the Guardian said possible culprits range from hostile states to criminal gangs to "enterprising teenagers", and interviewed defence and security editor Dan Sabbagh along with members of its global technology team.

A week of disruption

On Tuesday, seven planes were searched or diverted after malicious alerts. Aviation experts told the Guardian on Thursday that the decision by airlines to treat the threats as credible could suggest some level of coordination, though investigators have so far found no sign that a hostile state or terror group orchestrated them. Sabbagh noted that airlines receive bomb threats routinely, at a rate the public would find surprising.

The flight alerts came as aviation security was already under scrutiny after the flydubai incident, in which a pilot fought off a knife-wielding colleague in an apparent attempt to crash a full passenger flight bound for Tel Aviv.

The refrigeration attacks were reported in seven European countries, with thermostats in some cases remotely raised to 50C. Similar incidents occurred in the UK. One cybersecurity researcher said attacks on dummy Danfoss fridge controls — a system also targeted in mainland Europe — had "all the hallmarks" of operations linked to Russia.

Inside the 'grey zone'

Sabbagh describes a "grey zone": the ambiguous space between routine peace and conventional military conflict, where proxies avoid state accountability and cyber-tactics develop quickly. Since 2022, European states have recorded sabotage believed to trace back to Russia that deliberately stays below the threshold for military response. Two months ago, an alleged attack plot on RAF Fairford was organised by a handler police believe was working for Iran.

"Terrorism doesn't have to be violent to terrorise," Sabbagh said. "The purpose of terrorism is to scare."

Security services monitor threats continuously — MI5 has about 3,000 active subjects of interest — but lower-level activity is harder to detect, and resourcing is a factor.

Technology reporter Aisha Down said cyber-attacks are opportunistic, often exploiting "edge devices" that lack strong security. She cited Finland, where reports to the national cybersecurity centre rose from 18,000 last year to 21,000 this year in a population of six million. A European cybersecurity official told her there is, on average, a vulnerability in every 1,500 lines of code.

Against that backdrop, the UK government's Be Ready initiative advises households to keep 72 hours of emergency supplies. Sabbagh's counsel is simpler: don't panic and keep calm.

Source: The Guardian.