World · Ireland · Europe · Media
Ireland’s national broadcaster was evacuated in the middle of its morning output, its flagship radio programme replaced by recorded music, as emailed bomb threats emptied newsrooms from Dublin to Sofia on Friday. Reuters reported that no bomb was found at any affected site — but after a week in which the same campaign stopped airliners across Europe, nobody running a European newsroom was prepared to bet a building on the threat being empty.
DUBLIN, November 6, 2026 — The email arrived on a Friday morning, in inboxes across Europe, under a subject line written like a headline: “MESSAGE TO THE WEST.” It warned that “the clock is ticking,” and at RTÉ — Ireland’s national broadcaster — it named a place and a deadline: a device, the threat claimed, would detonate at the Donnybrook campus within 45 minutes. Within the hour, the campus at Montrose stood empty, the country’s most-listened-to radio station was filling its schedule with pre-recorded music, and journalists who normally report evacuations were standing outside their own buildings, waiting for permission to go back in.
By the time Gardaí finished searching the campus — a sweep that lasted more than three hours — the pattern had repeated across the Irish media. Mediahuis, publisher of the Irish Independent, evacuated its Talbot Street offices. Marconi House, home to Newstalk and Today FM, emptied. The Irish Mirror was reportedly evacuated. Virgin Media, at Ballymount, received the same threat. In London, Sky received the warnings. In Sofia, Nova TV’s newsroom was evacuated, searched by police and deemed safe. And in Copenhagen, police said they were at the airport again — the campaign’s original target, European aviation, still being probed on the same morning its newest one was being swept. Reuters reported the sentence that anchored the whole day: no bombs were found at any affected site.
Nine o’clock in Donnybrook: how RTÉ’s morning unravelled
The threat against RTÉ was received on Friday morning, and it was specific in the way designed to make it impossible to ignore: a named campus, a claimed device, a 45-minute fuse. The broadcaster evacuated the Montrose campus in Donnybrook, south Dublin. Morning Ireland — the most listened-to radio programme in the country — was interrupted after 9 a.m. as the building emptied. On RTÉ Radio 1, “Today with David McCullagh,” the flagship mid-morning show, was replaced by pre-recorded music and a recorded message; Reuters reported that some programming was replaced for up to three hours.
McCullagh’s programme eventually resumed in improvised form: the presenter broadcast from a mobile roadcaster unit, the outside-broadcast vehicle pressed into service as an emergency studio while the building it normally anchors stood silent behind police lines. Armed response units attended Donnybrook, and Irish reports described Defence Forces search teams and sniffer dogs working through the campus. Staff were allowed back only after Gardaí completed their sweep — more than three hours after the evacuation began — and confirmed that no device had been found.
There is a particular vulnerability in threatening a broadcaster, and Friday exposed it precisely. A radio station cannot quietly absorb an evacuation the way an office block can. Every stage of it — the interrupted programme, the recorded message, the music where the journalism should be — is transmitted, in real time, to the entire country. The disruption is not a side effect of the threat. For whoever sent it, the disruption is the product, and the victim is obliged to distribute it.
Talbot Street, Marconi House and a minute of dead air
RTÉ was the biggest target, but it was not the only one, and the geography of the Irish evacuations reads like a map of the country’s media industry. On Talbot Street, in Dublin’s north city centre, Mediahuis Ireland — publisher of the Irish Independent, one of the country’s largest newspapers — evacuated its offices. There, at least, the morning recovered quickly: staff were back at their desks by midmorning after the building was deemed safe.
At Marconi House, the city-centre home of Bauer Media’s Irish stations, the evacuation produced the day’s most quietly dramatic broadcast moment. On Newstalk, presenter Claire Byrne told her listeners that she, too, had to go off air — and then, for about a minute, there was dead air: a national talk station with nothing to say, because the people who say things were filing out of the building. Today FM, broadcasting from the same building, was evacuated alongside it. The Irish Mirror was also reported to have evacuated. Virgin Media, at Ballymount in west Dublin, received the threat; reports differed on whether it evacuated its buildings, and the careful summary is simply that the threat reached it too.
“MESSAGE TO THE WEST”: the email, and the name attached to it
The emails, according to the Irish and European reporting, warned that “the clock is ticking” and were signed “Mikhail Andropov” — a name presented by the author as one of the leaders of the group behind this week’s aeroplane hoaxes. That sentence requires immediate and careful qualification, because almost everything in it is a claim made by the sender. Irish media reported that the emails carried the signature and asserted the link to the flight threats. Neither the authorship nor the organisational link has been independently established. There is, at the time of writing, no verified evidence that a group by that description exists, that the person named wrote the emails, or that the same hand sent Friday’s media threats and the week’s aviation threats — only an assertion, in the emails themselves, that they are connected.
The distinction matters more than it might seem. A signature is the cheapest component of a threat: it costs nothing to type a name, and a name evoking a Soviet-era intelligence chief — Yuri Andropov ran the KGB and then the USSR — is doing theatrical work, inviting exactly the attribution debate the sender may want. Investigators will work from headers, infrastructure and language, not from the signature. Readers should do the same: the name is part of the performance, and the performance is the one thing about this campaign that is certainly real.
What is also real is the pattern the sender claims to be continuing: the media threats arrived on the fifth day of a rolling campaign against European aviation, close enough in style and timing that police in at least one country were back at an airport on Friday morning. Whether one actor or several imitators are responsible is what Europe’s security agencies say they have not yet determined — itself a measure of the campaign’s success, because uncertainty about the sender is what keeps every individual threat impossible to dismiss.
The official response: sweeps, armed units and a government choosing its words carefully
An Garda Síochána, Ireland’s police service, confirmed the shape of the morning in a short statement: “An Garda Síochána is aware of a threat made against media organisations here and in Europe… liaising with the Irish media organisations, and the threats will be investigated.” Behind that formula stood a substantial physical response: armed response units at Donnybrook, and, according to Irish reports, Defence Forces search teams and sniffer dogs working the campus. The RTÉ sweep alone consumed more than three hours of specialist time; multiply that across every evacuated building in Dublin, London and Sofia, and Friday’s email had, by lunchtime, commanded the working day of several countries’ security services.
At government level, the words were measured to the gram. Taoiseach Micheál Martin took the threat seriously, and said that European security agencies had not yet determined whether the threats were the work of individuals or part of a coordinated attack. Asked about possible Russian involvement, he declined to comment at this stage — a refusal that is itself information, underlining that no attribution has been made by the Irish government or, publicly, by any European agency. Tánaiste Simon Harris described a situation still evolving in real time. In Britain, Sky confirmed it had received the warnings. In Bulgaria, police searched Nova TV’s Sofia newsroom and declared it safe. And Copenhagen Police said on Friday that they were at Copenhagen Airport again in connection with threats directed at air traffic — one sentence that did more than any other to connect Friday’s media wave to the week that preceded it.
Background: the week the threats took to the skies
Friday’s newsroom evacuations are the second wave of a campaign that began in the air. On Monday, November 2, a Wizz Air flight from London Luton to Sofia was diverted to Budapest under Hungarian fighter escort after a threat. On Tuesday, at least seven flights were targeted. On Thursday came the peak: at least 25 flights affected across the continent, according to Reuters’ tally — an Aer Lingus jet diverted to the Évreux military base in France under fighter escort, a Finnair aircraft escorted into Rome, Ryanair flights intercepted by Bulgarian MiG-29s. Earlier threats in the same sequence had also reached a cruise ship. Not one explosive device was found, on any aircraft, at any point in the week. Signal Post News reported that wave in full: Hoax Bomb Threats Hit Dozens of Flights Across Europe as Fighter Jets Scramble.
Read the two waves together and a logic emerges. The aviation threats tested Europe’s most rehearsed security machinery — the diversion, the escort, the sterile search — and demonstrated that a message could move fighter jets. The media threats test something softer: institutions that cannot hide, cannot stop broadcasting while they respond, and whose every minute of disruption is itself public. A campaign that began by proving it could empty the sky over Europe ended the week by emptying the newsrooms of a capital city — in Ireland’s case, the week before Dublin hosts European leaders.
Why this matters
The target is the amplifier
Every threat campaign faces a distribution problem: a hoax only frightens people who hear about it. Targeting airlines solved that problem partially — each diverted flight generated its own news coverage. Targeting the media solves it completely. When you threaten a broadcaster, the broadcaster must report its own evacuation, live, to the whole country; the threat is carried, at the sender’s chosen moment, by the most trusted distribution network in the state. RTÉ playing recorded music where its flagship programme should be is a more vivid demonstration of reach than any diverted airliner, because it happened in every kitchen and car in Ireland simultaneously. Whoever designed this campaign — one actor or several — understands that in 2026 the scarcest strategic resource is not explosive; it is attention, and the surest way to seize it is to switch off the people who allocate it.
Why Ireland, and why this week
Ireland was hit hardest on Friday, and the timing is unlikely to be accidental. Ireland currently holds the presidency of the Council of the European Union, and next week Dublin hosts a summit of the European Political Community — dozens of leaders, their security details, and the European press corps converging on the Irish capital. A threat campaign that empties Dublin’s newsrooms days before that summit achieves several things at once: it rehearses, in public, the disruption it could cause during the summit itself; it forces Irish and European security services to spend the pre-summit week sweeping broadcasters instead of resting; and it guarantees that when leaders arrive, the host country’s media will frame the gathering against a backdrop of vulnerability its audience has just experienced first-hand. Add Ireland’s role as Europe’s English-speaking media and technology hub — a small country with an outsized voice in the Anglophone information space — and Dublin is close to the ideal stage for a message addressed, as the subject line put it, “to the West.”
The brutal arithmetic of a hoax
Now consider the cost ledger, because it explains why campaigns like this persist. The sender’s investment is an email account and an afternoon. The response, across one week, includes: fighter jets scrambled in at least four countries, at tens of thousands of euros per flying hour; dozens of diverted or searched airliners, with compensation and knock-on costs running into the millions; and, on Friday, armed police and military search teams deployed for hours across several capitals, plus a national broadcaster’s output degraded for a morning. The exchange ratio is not ten to one or a hundred to one; it is closer to a million to one. No conventional weapon available to a small actor offers that leverage, and Europe cannot simply stop reacting, because the one threat in a thousand that is real would be catastrophic — and the sender knows it. The campaign’s true payload is the reaction itself, purchased at no cost, repeated at will.
Attribution is a claim, not a conclusion
It would be easy — and, on current evidence, wrong — to convert Friday’s theatre directly into an attribution. The signature in the emails is unverified. The Irish government has pointedly declined to speculate about Russian involvement. European agencies, per the Taoiseach, have not established whether this is one coordinated actor, a small group, or opportunistic copycats amplifying each other’s work. Each possibility implies a different response: a state-directed campaign is an act of hybrid warfare demanding a diplomatic and security answer; a lone hoaxer is a criminal investigation; copycats are a contagion problem in which publicity is the transmission vector — an uncomfortable thought for the media organisations that must report the story, and one more reason the choice of targets was so cynical. Until investigators publish evidence, the honest position is the one Dublin took on Friday: treat every threat as real, and every claim about its author as unproven.
What happens next
The investigation now runs on two tracks. In Ireland, Gardaí will work the email’s path into the newsrooms’ inboxes, in liaison with European counterparts doing the same in London, Sofia and elsewhere; the cross-border sameness of the message is the strongest lead, and the strongest argument that Friday was coordinated at least at the level of a shared text. In parallel, the aviation track remains live: Copenhagen Police were at Copenhagen Airport again on Friday, and no authority in Europe will treat the flight campaign as closed while the media campaign is open. Watch for three things in the coming days: whether the threats recur against the Dublin summit itself, which would confirm the timing analysis; whether any agency moves from “not yet determined” to a formal attribution, converting a police matter into a diplomatic crisis; and whether newsrooms and airlines quietly change their thresholds — shorter sweeps, partial evacuations, broadcast-from-the-car-park protocols of the kind RTÉ improvised on Friday. The long-term contest is not over any single device that does not exist. It is over who gets tired first: the sender, or the institutions that must answer every email as if it were the real one.
For Ireland’s newsrooms, Friday ended the way it was always going to: with the staff back inside, the programmes back on air, and the story told by the people it happened to. That is not nothing. The campaign demonstrated it could silence a country’s media for a morning; it also demonstrated that the silence lasts exactly as long as a police sweep, and that the first thing a freed newsroom does is explain, in detail, who tried to silence it. Whether that arithmetic discourages the sender or merely advertises his reach is the question Europe’s investigators now have to answer — before the leaders land in Dublin.
Sources
Reuters, November 6, 2026 — the emailed threats titled “MESSAGE TO THE WEST” and signed “Mikhail Andropov”; the evacuation of RTÉ’s Donnybrook campus and the interruption of Morning Ireland and “Today with David McCullagh,” with some programming replaced for up to three hours; the evacuations or warnings at Mediahuis, Marconi House, Sky and Nova TV; and confirmation that no bombs were found at any affected site. RadioToday Ireland, November 6, 2026 — the 45-minute detonation claim against the Donnybrook campus, the mobile roadcaster broadcast, the return of staff after a Garda sweep of more than three hours, the Marconi House evacuation including Claire Byrne’s on-air announcement and the minute of dead air, and Copenhagen Police attending Copenhagen Airport in connection with threats to air traffic. Irish media reporting, November 6, 2026 — the Irish Mirror evacuation reports, Virgin Media receiving the threat at Ballymount, Mediahuis staff returning by midmorning, and reports of Defence Forces search teams and sniffer dogs at Donnybrook. An Garda Síochána statement, November 6, 2026; statements by Taoiseach Micheál Martin and Tánaiste Simon Harris, November 6, 2026. Week’s aviation context: Reuters tallies of at least 25 flights affected on November 5, 2026, and Signal Post News reporting on the November 2–5 flight threats.