The Romanian intelligence agency said late on Thursday that two additional planes had received bomb threats, including a KLM flight to Tel Aviv with a layover in Bucharest.
The pilots requested a pyrotechnic inspection of the aircraft, it said. A bomb threat was made earlier on a Wizz Air flight from Milan to Bucharest, as hoax threats disrupted at least 27 passenger flights across Europe on Thursday.
No government has said who was behind the threats, and no claim of responsibility has been verified. Security experts said it could be individuals acting on personal grievances or copycats, but also that it had the hallmarks of a more coordinated "hybrid attack."
No culprit found yet
Bulgaria's air force said its fighter jets had escorted three airliners to the ground. One Ryanair flight from London to Sofia was diverted to Plovdiv, Bulgaria's second city.
Spanish police said three emailed threats came in within 20 minutes involving two Air Europa departures from Madrid to Paris and four inbound Iberia flights from Rome and Milan. Several aircraft were halted or returned to their stands in Madrid, and passengers disembarked as the aircraft were inspected.
In Warsaw, a LOT flight to Paris was stopped as it taxied towards take-off and passengers were transferred to another plane, while Danish police said two planes were searched at Copenhagen airport.
Other flights that received threats, including EasyJet, Finnair, LOT, Wizz Air, Ryanair and Air Serbia services to Prague, Sofia, Vienna, Brussels, Bucharest, Rome and Milan, landed as scheduled, some after military escorts.
Eliran Almog, CEO of aviation cybersecurity firm Cyviation, said the hoaxes could serve both to disrupt operations and to observe how airlines, airports and authorities respond.
"These aviation threats are also occurring in the same period as cyberattacks on supermarket refrigeration systems across Europe," Almog said.
"Different essential services are experiencing disruption that carries economic costs and can undermine public confidence."