# Europe hoax bomb threats, 5 November 2026: ADS-B and flight-status dataset

Open data behind the SkyLink API case study
<https://skylinkapi.com/blog/case-study-europe-bomb-threats-november-2026-adsb-flight-status/>.

On Thursday 5 November 2026 hoax bomb threats were sent against flights across
Europe. Reuters counted at least 27 affected flights. No explosives were found.
This dataset holds full-resolution ADS-B tracks for the threatened flights we
could identify, the aircraft that recovered two of them, schedule and status
observations from airport boards, and the day's board-level cancellations and
diversions.

## Licence

**Creative Commons Attribution 4.0 International (CC BY 4.0).** You may copy,
redistribute, adapt and build on the data for any purpose, including commercial
use, as long as you give credit. Full terms: <https://creativecommons.org/licenses/by/4.0/>.

Suggested attribution:

> Source: SkyLink API, "Europe hoax bomb threats, 5 November 2026" dataset
> (skylinkapi.com), licensed CC BY 4.0.

The data is provided as is, without warranty. It is not certified for
operational, legal or safety use.

## Files

| File | What it holds |
|---|---|
| `flights_index.csv` | One row per tracked flight: airline, callsign, hex, route, outcome, role (`threatened flight`, `recovery flight`, `candidate, not confirmed`). Start here. |
| `positions_all.csv` | Every position row for the 12 tracked flights in one table, with a `flight_label` column. |
| `positions/<flight_label>.csv` | The same positions, one file per flight. |
| `flight_legs.csv` | SkyLink flight-leg records (takeoff, landing, airports) for the same aircraft. Leg splitting is noisy where coverage drops: one flight can appear as two or three legs. |
| `schedule_observations.csv` | Schedule and status observations for the selected flight numbers and callsigns, from airport departure and arrival boards and SkyLink's own ADS-B matching, with fetch times. |
| `board_cancellations_diversions_2026-11-05.csv` | Every board entry with status "diverted" or "cancelled" on 5 November across the boards SkyLink monitors. **Most rows are unrelated** (weather, technical, and US entries from the FAA SWIM feed); it is context, not a list of threatened flights. |
| `prague_candidates/prague_arrivals_candidates.csv` and track files | Czech police said four Prague-bound flights were threatened but never named them. This is **every** easyJet, Ryanair, Austrian and Sky Express arrival at Prague (LKPR) between 08:00 and 14:00 UTC, with the last 75 minutes of each track. **A candidate set: inclusion does not mean a flight was threatened.** |

## Position columns

| Column | Meaning |
|---|---|
| `flight_label` | Which flight the row belongs to (see `flights_index.csv`). Only in `positions_all.csv`. |
| `timestamp` | UTC, ISO 8601. Roughly one row every 5 seconds. |
| `icao24` | Transponder hex address. Read it as text to keep leading zeros. |
| `callsign` | Callsign broadcast at that moment. One aircraft can fly several callsigns in a file (positioning, return legs). |
| `registration`, `aircraft_type` | From SkyLink's aircraft database, when known. |
| `latitude`, `longitude` | WGS-84 degrees. |
| `altitude_baro` | Barometric altitude, feet. Parked aircraft show airport elevation, not zero. |
| `ground_speed` | Knots. |
| `track` | Degrees true. |
| `vertical_rate` | Feet per minute. |
| `is_on_ground` | As reported. Not always reliable (see caveats). |
| `gps_spoofed` | SkyLink's per-row GNSS-spoofing flag, where computed. |
| `stale` | **Added for this release.** The feed repeated an earlier value instead of a new one. Drop these rows for track analysis. |
| `implausible` | **Added for this release.** The position can't be real: under 60 kt above 10,000 ft, or a jump from the last good point faster than 750 kt. Drop these rows for track analysis. |

`stale` is true when the position didn't change while the reported speed says
the aircraft was moving, when ground speed, track and altitude stayed exactly
identical for three minutes or more while moving, or inside two windows found by
hand: FR1730 from 09:10 to 13:01, and LOT5KH on the ground at Brussels from 08:30
to 11:47.

## Caveats

- All times are UTC. Central European Time was UTC+1.
- Coverage thins over Bulgaria and Romania: tracks into Sofia, Plovdiv and
  Bucharest have gaps, and both Bucharest candidates end before landing.
- No squawk history was stored, so emergency codes (7700, 7500) can't be shown.
- Fighter escorts reported by the press are not in the data. We checked every
  aircraft within 8 nm and ±5,000 ft of the threatened flights for three
  minutes or more in their final ~90 minutes: no military transponders appeared.
- Both Finnair flights from Helsinki show impossible positions over the Baltic
  (for example 24 kt at 38,000 ft), consistent with the GNSS interference widely
  reported in that region. Those rows are flagged `implausible`.
- The aircraft database lists hex `4d21dd` (the diverted Wizz Air aircraft) as a
  CRJX registered 9H-LKF. That record is wrong for this airframe; ignore it.
- The two Milan–Bucharest Wizz Air flights are candidates: press reports say the
  Milan–Bucharest flight was threatened on approach, but not which one.
- Schedule observations are what each source published at fetch time, including
  statuses that later turned out to be wrong. That is deliberate.

## Not included

Two context files from the original export were left out: tracks of French Air
Force transports based at Évreux that day (routine, unrelated to the threats)
and a Wizz Air flight first matched as Milan–Bucharest that actually flew to
Sicily.

## Provenance

Exported on 6 November 2026 from SkyLink's ADS-B archive and flight-information
database. Positions come from community ADS-B receiver networks aggregated by
SkyLink. Schedule observations come from public airport flight boards and the
FAA SWIM feed.