Suspected Russian hybrid attacks have struck Europe this week, with hoax bomb threats grounding dozens of flights and pro-Russian hackers leaking Italian Foreign Minister Antonio Tajani's personal data on the dark web .
The bomb hoaxes began on Tuesday and continued through Saturday. Around half a dozen flights were disrupted on Tuesday and more than two dozen on Thursday. Some aircraft made unplanned landings or were escorted by fighter jets. The North Atlantic Treaty Organization (NATO) ordered air patrols in the area. Newsrooms in Ireland and Bulgaria received emailed threats from a purported "Mikhail Andropov" headlined "Message to the West." No explosives were found, and all planes landed safely .
Italian Foreign Minister Antonio Tajani said on Saturday that cybercriminals had spread his personal data on the dark web for days. The pro-Russian group NoName057(16) published a list of roughly 18 European figures on a dark-web section called "Tribunale." The group is widely described as linked to Russia's military intelligence agency, the GRU. The figures were labelled "enemies of the Russian Federation." The profiles included phone numbers, home addresses and offers of payment for additional information on family members. Other Italians on the list included Rome prosecutor Francesco Lo Voi and postal police chief Ivano Gabrielli .
Tajani attributed the campaign to Italy's support for Ukraine. "Our position on Ukraine is the political reason why I have come under fire," he wrote on X. He said the actors "involve my family as well" and "are ready to pay for other details about me and my loved ones." Prime Minister Giorgia Meloni expressed "full solidarity" with Tajani and blamed "pro-Russian hackers," calling the sale of confidential information "a matter of grave concern that must be addressed with the utmost determination" .
European intelligence agencies are investigating whether the bomb threats originated in Russia. Paris prosecutors are examining whether the email hoaxes targeting flights over France have links to "foreign powers" . The incidents follow cyberattacks on supermarket freezers in several countries that raised temperatures and spoiled food. Italy's government said civilian infrastructure in Europe is "under attack" . European technology commissioner Henna Virkkunen told Reuters that since 2022 Europe had faced hybrid operations including sabotage of critical infrastructure, drone incursions and cyber breaches. "We are under attack all the time," she said .
The Rome prosecutor's office has opened an investigation into the dark-web leak. Tajani said he had created a dedicated "cyber directorate" at the Foreign Ministry on January 1 to counter intrusions "often linked in some way to state entities hostile to us." He said he "will not be intimidated in any way." The group NoName057(16) had previously claimed DDoS attacks — designed to make websites unreachable — against Italian institutional websites. In July 2025, an international police operation led by Germany's Federal Criminal Police Office (BKA) dismantled the group's IT infrastructure, but it remained active .
