Romania found no bombs on targeted flights. The senders remain unknown

Three aircraft were checked

The four alerts at Henri Coandă referred to aircraft arriving from Milan and Belgrade, a KLM service continuing to Tel Aviv and one message that named no target. Romanian teams inspected the three identified aircraft and baggage, disembarked passengers where required and activated airport crisis procedures. The airport operator said traffic continued according to schedule.

Each specified message forced crews and security personnel to decide before knowing whether it was genuine. Aircraft searches, passenger handling and diverted staff impose costs even when no device is found. The response demonstrates that procedures were applied under uncertainty. It supplies no evidence about who sent the messages.

The negative searches resolve the immediate factual question for the three aircraft inspected by Romanian authorities. Sender identity, motive and possible links among the alerts remain open. Investigators need the original communications and account records to distinguish one operator from several people copying the same tactic.

The European count needs context

The Associated Press reported 14 threatened flights on Thursday, compared with seven on Tuesday. Fourteen amounted to about 0.05% when set against Eurocontrol’s approximately 28,400 flights that day. The EU transport commissioner reported another 11 threats on Friday. Reuters documented Bucharest-linked services among flights affected across several countries.

“Romanian authorities reported negative searches. Attribution still depends on evidence from the messages and the accounts behind them.”

The European network continued to operate at scale. Individual airports and crews still faced repeated decisions with immediate safety consequences. Country totals can also overlap when the same aircraft departs from one jurisdiction, receives a threat in flight and lands in another. A Europe-wide incident count therefore cannot be added to Romania’s four alerts as if every report described a separate flight.

Attribution requires links between the senders

SRI spokesperson Ovidiu Marincea said the authors’ identities and possible links among the threats remained under investigation. He also warned that public claims about origin do not constitute evidence. Romanian investigators have not identified Russia, another government or a named movement as directing the wave.

Investigators can test coordination through common email infrastructure, account-registration data, payment trails, message metadata and communication between suspects. Similar wording supplies a lead because it can be compared across cases. It can also be copied, and several senders can choose the same target during a widely reported scare. Timing alone cannot identify an organiser.

The EU activated its aviation-security information-sharing mechanism. National authorities remained responsible for assessing the threats, conducting investigations and applying aviation-security measures. Shared records can reveal whether message headers, sending accounts, server infrastructure or timestamps recur across national case files.

Romania’s evidence establishes four alerts, operational responses to three named aircraft, negative searches and continued scheduled traffic. A single European campaign remains unproven. Common sender infrastructure, controlled accounts, funding or a documented command chain would change that judgment. Until investigators publish such a link, “a wave of threats” describes their concentration in time without identifying who organised them.