Riyadh Airport Under Attack: Saudi Arabia Duty of Care Now
On Thursday, 8 October 2026, King Khalid International Airport in Riyadh was struck by Houthi missiles. Three Saudi nationals were killed. Flights were diverted or cancelled. Within hours, the European Union Aviation Safety Agency - EASA - updated its conflict zone bulletin to warn commercial airlines about the risk of flying into Saudi airspace.
That was day one.
By Sunday, Riyadh airport had been hit twice more. At least 12 people were killed in a single strike on 10 October, with over 300 injured. Another attack followed a day later, killing one more. The Houthis promised further strikes. Lufthansa Group suspended Riyadh routes. Three Indian carriers followed. OPSGROUP - the aviation intelligence network used by nearly 10,000 flight operations professionals - issued a blanket “do not fly” warning for Saudi Arabia, telling its members to stop using Saudi airports even as en-route alternates.
If you have employees in Saudi Arabia right now, you are managing a live duty of care event. If you are planning to send someone there in the next 30 days, your risk assessment needs a rewrite.
Five Days, Three Strikes, at Least 16 Dead
The attacks followed a pattern that has become familiar in the Yemen conflict, but the targets have not. Houthi forces have struck deep inside Saudi territory before - oil infrastructure, military sites, the occasional border town. King Khalid International Airport in Riyadh, Saudi Arabia’s second-busiest hub handling roughly 813 flights per day in 2025, is a different category of target.
The first strikes on 8 October killed three people and injured several more, prompting Saudi authorities to issue an initial warning. The Houthis confirmed responsibility and, critically, issued a formal warning to airlines: stop flying into Saudi airspace or risk being caught in the conflict.
Most airlines did not take that warning seriously enough, fast enough.
Two days later, on 10 October, a missile hit a passenger terminal at King Khalid. At least 12 people were killed and more than 300 injured, according to AP. By the following morning - 11 October - another projectile had struck the same complex. One more person was dead.
Flight tracker FlightRadar24 showed 131 flights to and from Riyadh cancelled on 10 October alone. That figure does not include the hundreds of cancellations that occurred in the preceding 48 hours.
Why the Aviation Risk Is Bigger Than the Headlines Suggest
Airlines suspending service to Riyadh is the visible disruption. The less visible risk is what EASA flagged in its updated conflict zone bulletin: missile and drone attacks, combined with active Saudi air defence systems, create conditions where a civil aircraft can be misidentified.
EASA’s exact language matters here. The agency said: “These recurrent missile and drone attacks, together with the activation of air-defence systems, create an increased risk of misidentification of civil aircraft, as well as risks associated with missile and drone overflights, interception activity and falling debris.”
That is not bureaucratic boilerplate. That is the same scenario that brought down MH17 over eastern Ukraine in 2014 and PS752 over Tehran in January 2020. Air defence systems operating under stress, tracking fast-moving objects at night, do not always distinguish between military threats and commercial aircraft. The presence of active engagement - not just the original Houthi threat - is what pushed EASA to expand its no-fly zone recommendation to include northwestern Saudi Arabia.
OPSGROUP went further than EASA. It recommended that aviation professionals avoid Saudi Arabia entirely - including using Saudi airports as emergency alternates. “We now recommend avoiding operations in Saudi Arabia entirely, including the use of Saudi airports as en route alternates,” its memo read, as reported by Reuters.
The US Embassy in Riyadh has maintained a Level 3 - Reconsider Travel advisory for Saudi Arabia throughout this period, citing Iranian drone and missile targeting, armed conflict, and terrorism risks. US government employees working in Saudi Arabia were already required to seek special authorisation before using King Khalid International Airport.
Who This Affects in Your Organisation
The obvious affected population is anyone with a scheduled flight through Riyadh. But the duty of care circle is wider than that.
Business travelers transiting through Riyadh. King Khalid is a connecting hub for routes between Europe, South Asia, East Africa, and Southeast Asia. Even travelers not flying to Saudi Arabia may be booked on routes with Riyadh connections. If a European airline suspended Riyadh operations mid-week, travelers already mid-journey faced real disruption without alternative routing pre-arranged.
Resident employees and long-term assignees. Saudi Arabia is home to tens of thousands of expatriate workers across oil and gas, construction, engineering, financial services, and government contracting. Many organisations with staff in Riyadh have not contacted those people since the first strike. That is a gap.
Contractors and third-party personnel. Duty of care does not stop at the boundary of direct employment in most jurisdictions. If your organisation procures services from contractors whose people are in Saudi Arabia, you have at minimum a reputational exposure and potentially a legal one, depending on how your contracts are written.
Upcoming travel scheduled in the next 30-60 days. Travel that was approved two weeks ago under a different threat picture needs reassessment. The conflict has escalated. The advisory level has not changed, but the operational reality has.
What to Do Right Now
This is not a situation that calls for monitoring. It calls for action on several fronts simultaneously.
1. Locate every person you have in Saudi Arabia today. Not the ones you think are there - the ones who are actually there. Use your travel management company data, HR records, and if you have a travel risk platform, its last-known location data. Cross-reference against your itinerary data for anyone in transit. You may have people in Riyadh you are not aware of.
2. Make contact - do not wait for people to call you. The welfare check should come from the organisation, not from the traveler. Send a direct message or call to every confirmed person in-country. Establish that they are safe, where they are, and what their exit options look like. Document the contact and the response.
3. Suspend new travel approvals to Saudi Arabia pending a formal reassessment. Any travel booked but not yet departed should go through a new pre-trip risk review that accounts for the current attack pattern, airline suspensions, and EASA guidance. The pre-trip assessment you ran last month is no longer valid.
4. Check your insurance position. Standard corporate travel insurance typically excludes losses arising from war and political violence. If your people are in Saudi Arabia, confirm now - before anything happens - whether your policy covers medical evacuation, business interruption, and political violence claims in the current threat environment. Malicious risk policies covering terrorism and political violence are separate products; if you do not have one, you have a gap. Review HAAVYN’s duty of care platform for integrated coverage options.
5. Plan for airspace closure scenarios. If Saudi authorities close Riyadh airspace entirely - a realistic outcome if attacks continue - how do your people get out? Jeddah (King Abdulaziz International Airport) is the alternative hub, but it is 950 kilometres away. Ground transport between Riyadh and Jeddah takes roughly 9-10 hours by road. What is your approved land evacuation route? Who authorises it? Does your traveler assistance provider have ground transport capability in-country?
6. Communicate clearly with business leadership. The C-suite may not fully understand that an EASA no-fly advisory for Saudi airspace is not a travel delay - it is a signal that international aviation bodies believe the risk of civil aircraft being caught in active combat operations is unacceptably high. Brief your leadership now, before you need to explain a serious incident.
The Broader Pattern You Cannot Ignore
Saudi Arabia has been a target of Houthi attacks for years. The difference in October 2026 is the target selection - a major civilian airport in the capital - and the demonstrated ability to conduct repeat strikes against the same target within 48 hours. That persistence matters.
When OPSGROUP recommends that airlines avoid a country’s airspace entirely, and EASA expands its conflict zone advisory, and Lufthansa suspends a major hub route, it signals a threshold has been crossed. This is not a one-off incident in a remote area. This is sustained, deliberate targeting of civilian infrastructure in a country that many organisations treat as a routine business travel destination.
The organisations that manage this well will be the ones that already had a current contact list, a functioning communication protocol, a pre-approved evacuation route, and malicious risk coverage that extends to political violence. The ones that struggle will be the ones who relied on last quarter’s risk assessment and assumed the travel advisory level told the whole story.
An advisory level is a starting point. The threat picture this week in Riyadh is considerably worse than the Level 3 label suggests.
HAAVYN’s Radar platform tracks over 1,200 intelligence sources across 220+ countries and territories in real time, including active conflict zone monitoring, airline route disruption alerts, and government advisory changes. If your organisation needs to understand what is happening on the ground in Saudi Arabia right now - and what your people’s options are - book a call with our team.
