It seems that when the Lithuanian government realized that the bomb threat was a hoax, ProtonMail was contacted.

Specifically: ' IP addresses, email addresses, and phone numbers provided are saved temporarily in order to send you a verification code and for anti-spam purposes' ' Data related to the opening of an account' details the steps taken to prevent abuse and protect users. However, I was given the following response in broad reference to the company's privacy policy. I reached out to ProtonMail asking how this was possible, and I was told that the company does not comment on specific cases. The company's commitment to privacy (as shown by the contents of the emails and mailbox being fully encrypted) would have led many to believe that it would have been unable to recover the IP address. However, many may be surprised that ProtonMail was able to release the IP address of the account creator in the first place. 'We are supporting European authorities in their investigations, as we are legally obligated to do so on the basis of an official request from the Swiss government.' ProtonMail said in a statement in May 2021 that it had been compelled by an official request by the Swiss government to divulge the information that it had, though made clear that the email itself was released by investigative journalists. The United States has also recently accused the Belarusian government of 'air piracy' following the incident, charging four Belarusian government officials.

Investigators in Lithuania launched a pre-trial investigation into the matter, which is why ProtonMail was compelled through a 'mutual legal assistance mechanism' to release the IP address to authorities. Following the plane's landing in Minsk, both journalist Roman Protasevich and his girlfriend Sofia Sapega were arrested.

Protonmail reddit