Editorial Product

SafeExpat DOSSIER

Executive Summary

Investigations conducted in Germany, Austria, Denmark, Greece and Cyprus have identified individuals, weapons, potentially explosive materials and logistical channels suspected of being connected to Hamas or affiliated operational structures.

Publicly confirmed evidence points primarily to a potential capability to prepare attacks against Israeli or Jewish targets in Europe. At this stage, it does not prove the existence of a verified plan for simultaneous mass-casualty attacks across several European countries.

The description of a “second 7 October” and the identification of 7 October 2025 as a possible operational date originate from a journalistic investigation attributed to the Neue Zürcher Zeitung. These elements have not been formally confirmed in the public statements issued by the relevant authorities.

For expatriates, international companies and global mobility professionals, the signal does not justify avoiding Europe as a whole. It does, however, require increased awareness around Israeli and Jewish facilities, diplomatic premises, symbolic events and high-visibility transport or tourism locations.

Signal

The most operationally significant development is not one individual arrest, but the convergence of several national investigations into a possible cross-border support infrastructure.

In November 2024, Germany’s Federal Prosecutor charged four alleged Hamas members, stating that the organization had established underground weapons caches in several European countries. According to prosecutors, some of the suspects had been instructed to locate the weapons so they could be made available for possible attacks against Jewish institutions.

On 1 October 2025, German authorities arrested three additional suspects. The Federal Prosecutor stated that the seized weapons were intended to be used by Hamas in lethal attacks against Israeli or Jewish facilities in Germany. Further arrests connected to the acquisition and transfer of weapons followed in November 2025.

In Austria, the Directorate of State Security and Intelligence discovered five handguns and ten magazines inside a rented storage facility in Vienna. Austrian authorities attributed the cache to Hamas-linked foreign operational structures and stated that the weapons had allegedly been brought into the country for possible attacks against Israeli or Jewish targets in Europe. A British national suspected of being connected to the cache was arrested in London on 3 November 2025.

In Denmark, the PET intelligence service linked a counterterrorism investigation launched in 2023 to individuals suspected of maintaining connections with both Hamas and criminal networks. In May 2025, a man was remanded in custody over allegations that he had participated in purchasing drones intended for a possible Hamas-linked attack in Denmark or abroad.

A further development emerged in June 2026. Greek police arrested a 37-year-old Palestinian man in Crete on suspicion of belonging to Hamas and preparing attacks. Investigators identified purchases of chemicals potentially suitable for producing explosives and connections to four Palestinians arrested in Cyprus. Greek authorities also reported that the suspect had travelled to Malaysia, allegedly to learn methods for manufacturing explosives using commercially available substances.

These incidents do not automatically prove that all the cases were directed through a single command structure. They do, however, indicate that the possibility of external operational networks, logistical facilitators and pre-positioned capabilities in Europe can no longer be treated as theoretical.

Assessment

The principal strategic implication is the possible transition from predominantly political, financial or support activity to a more concrete operational capability.

Weapons stored in advance, intermediaries operating across several countries, transfers through Europe’s internal borders and materials that may be used to manufacture explosive devices are all components of an infrastructure capable of remaining inactive for long periods.

Such a network does not require an immediate attack plan to create exposure. The availability of weapons, contacts and logistical cover reduces the time required to transform future intent into operational activity.

The investigation attributed to the Neue Zürcher Zeitung claims that some activities were intended to support an attack on 7 October 2025 and describes the alleged plan as a possible European “second 7 October.” The same reporting refers to weapons caches, surveillance of potential targets and a prerecorded claim-of-responsibility video.

These details are based on journalistic access to investigative files and have not been fully confirmed in public by the relevant authorities. Hamas has also denied connections with the arrested individuals.

The official statements reviewed do not confirm plans for mass incursions, coordinated kidnappings, sexual violence or a complete tactical replication of the 7 October 2023 attack. The public evidence instead supports allegations involving the preparation or facilitation of attacks against specific targets, primarily Israeli and Jewish facilities.

For international mobility risk, this distinction is essential.

The threat does not appear evenly distributed across Europe. Exposure is more likely to be concentrated around symbolic targets, public events, infrastructure used by Israeli nationals and locations where an attack could generate significant visibility and media impact.

Demonstrations opposing Israeli government policies, political activism and expressions of solidarity with Palestinians should not automatically be associated with terrorism.

Risk assessments must remain focused on operational indicators such as weapons procurement, target reconnaissance, clandestine financing, explosives acquisition and verified organizational connections.

Exposed Groups

The most exposed groups include:

  • Israeli nationals and members of Jewish communities living in or travelling through Europe;
  • personnel working at Israeli embassies, consulates, cultural centres and affiliated organizations;
  • Jewish schools, places of worship, associations and commercial premises;
  • passengers and employees of airlines, cruise operators and tourism companies associated with Israeli interests;
  • hotels, ports, airports and service providers hosting high-profile groups or delegations;
  • organizers of political, religious or commemorative events;
  • international companies with employees located near diplomatic or sensitive facilities;
  • global mobility teams responsible for business travel, events and temporary accommodation;
  • NGOs and humanitarian organizations that may face additional compliance checks, reputational pressure or indirect consequences from reinforced security measures.

Exposure for the general population and ordinary visitors remains lower, except where individuals are incidentally present near a potential target or active security operation.

Operational Impact

Reinforced Security Measures

Visible or discreet security protection is likely to increase around synagogues, embassies, schools, airports, ports and events connected to Israel, Jewish communities or the Israeli-Palestinian conflict.

Additional Checks and Delays

Enhanced screening of baggage, vehicles, suppliers and personnel may cause delays at airports, cruise terminals, hotels and high-profile events.

Itinerary Changes

Transport companies and tourism operators may alter routes, port calls, schedules or procedures if specific threats emerge against Israeli passengers, vessels or commercial interests.

Police Operations

Further arrests, searches or precautionary evacuations could cause localized disruption, road closures and temporary access restrictions.

Reputational and Social Risk

Incomplete or misleading reporting may fuel antisemitism, Islamophobia or generalized accusations against entire communities.

International companies and organizations should avoid circulating unverified claims and maintain a clear distinction between operational threats, religious identity and legitimate political expression.

Compliance and Due Diligence

NGOs, charitable organizations and companies conducting international payments may face tighter scrutiny concerning beneficiaries, financial intermediaries, partner associations and the final use of transferred funds.

Likelihood

Elevated

The existence of arrests, weapons seizures and coordinated investigations demonstrates a more concrete capability than a purely ideological threat.

The discovery of weapons already stored in Europe increases the possibility that additional resources, facilitators or caches may not yet have been identified.

However, the likelihood of a coordinated, large-scale attack cannot be assessed as high based on the public information currently available.

Several suspected operations have been disrupted, key individuals are under investigation or in custody, and authorities have not issued public warnings indicating an imminent threat to the general population.

Time Horizon

3–6 months

The investigations involve multiple jurisdictions and require the analysis of digital devices, weapons movements, international travel, financial connections and possible accomplices.

During this period, additional arrests, weapons caches, criminal proceedings or protective measures may emerge.

Immediate operational effects are likely to remain localized, while determining the actual scale and structure of the suspected network will require a longer investigative horizon.

For Expatriates and Travellers

  • Review official local security notices before attending Israeli, Jewish or conflict-related events.
  • Avoid remaining near police cordons, security operations or the entrances of heavily protected facilities.
  • Allow additional time for screening at airports, ports, cruise terminals and high-profile venues.
  • Confirm operational changes directly with transport providers or event organizers rather than relying exclusively on social media.
  • Avoid sharing real-time photographs that reveal security arrangements, protected entrances or the movements of sensitive personnel.

For Families and International Residents

  • Identify a family meeting point in case transport closures or localized evacuations prevent normal travel.
  • Ensure schools, childcare providers and other family facilities have updated emergency contact information.
  • Explain increased security procedures to children without using alarming or speculative language.

For Companies and Global Mobility Teams

  • Map offices and employee accommodation located near embassies, places of worship or other sensitive sites.
  • Integrate alerts concerning localized closures, police activity and transport modifications into travel risk procedures.
  • Review emergency arrangements with hotels, transport providers, event organizers and security suppliers.
  • Avoid country-wide generalizations. Assess risk according to the specific city, district, event and traveller profile.
  • Strengthen due diligence covering donations, partner organizations, intermediaries and transfers involving areas exposed to terrorism-financing risks.

For Hotels and Event Venues

  • Report concrete suspicious behaviour to the authorities without treating nationality, religion or ethnicity as indicators of threat.
  • Protect information concerning delegations, group itineraries, room allocations and transport arrangements.
  • Restrict unnecessary access to technical areas and building management systems.
  • Maintain procedures for temporary lockdowns, controlled evacuations and communication with guests.

Watch Indicators

Monitor the following developments:

  • new statements from Germany’s Federal Prosecutor and European security services;
  • further discoveries of weapons or explosive materials;
  • arrests connected to the same facilitators, telephone numbers, financial channels or travel routes;
  • official disclosures concerning targets that may have been placed under surveillance;
  • changes to national terrorism-alert levels;
  • increased protection around Israeli and Jewish facilities;
  • flight, cruise or public-event cancellations and diversions;
  • embassy advisories directed at Israeli nationals or Jewish communities;
  • online threats containing specific dates, locations or operational instructions;
  • terrorism-financing investigations and the misuse of nonprofit organizations;
  • judicial developments clarifying whether the separate cases formed part of a coordinated network.

Confidence Level

Medium

Confidence is high regarding the individual arrests, the Vienna weapons cache, the German investigations, the Danish proceedings and the investigative links between Greece and Cyprus.

These elements are supported by official statements and reporting from established media organizations.

Confidence is lower regarding the existence of a single centralized plan, the alleged operational date of 7 October 2025 and the description of a campaign equivalent to the 2023 attack.

These claims derive primarily from the Neue Zürcher Zeitung investigation and have not been fully published or independently confirmed by the relevant authorities.

SafeExpat Assessment

The most important signal is not that Europe as a whole faces an imminent attack.

It is that structures suspected of being connected to Hamas may have demonstrated the ability to store weapons, use intermediaries and operate across several European jurisdictions.

This reduces the distance between intent and operational capability and requires international organizations to adopt a more granular approach to risk assessment.

Exposure remains concentrated primarily around Israeli, Jewish, diplomatic and symbolically significant targets.

For expatriates and travellers, the appropriate response is not to avoid Europe, but to recognize sensitive environments, follow official instructions and maintain operational flexibility around major events, ports, airports and protected facilities.

SafeExpat assesses the situation as a credible but selective transnational threat: operationally significant, still only partially understood and not equivalent to an indiscriminate campaign against the European public.