Photo: Квіткослава / Wikimedia Commons, CC BY-SA 4.0
The smartphone apps that millions of Ukrainians and Russians rely on to know when to take shelter were taken over by hackers on Sunday night, flooding users with false warnings of radiation, chemical attacks, street fighting and even incoming nuclear warheads. Authorities in both countries confirmed the breaches on Monday, but neither has said who carried them out or whether the two attacks were linked.
Seven minutes of fake alarms in Ukraine
In Ukraine, the official Air Alert app, built by the Digital Transformation Ministry together with security firm Ajax Systems, issued 122 bogus alerts across the country between 10:47 pm and 10:54 pm Kyiv time. Most warned of missiles or drones, but some told residents of Kyiv and other areas to expect radiation, a chemical attack, artillery fire or fighting in the streets. Several messages were written in Russian, and one told users not to worry because the Oreshnik, Russia’s hypersonic missile, was on its way.
The air force put out a statement on Telegram at 11:02 pm saying the app had probably been subjected to hostile interference.
There is no radiation threat! Stay calm and follow our updates on our channel.
Ukrainian Air Force
The developers switched off push notifications and suspended the app. Regional governors in Ivano-Frankivsk and Vinnytsia told residents the situation was calm, and Vinnytsia’s governor warned people not to click a link included in one of the messages. The false alerts were cleared within about an hour, and the State Emergency Service said the nationwide warning system was working normally by midnight.
Russia’s emergencies app hit hours later
Early on Monday, Russia’s Ministry of Emergency Situations said its mobile app had suffered a massive cyberattack that let intruders push fake information to the public. Screenshots of the messages claimed nuclear warheads had been launched at every region of Russia and urged people to stock up on three weeks of food and hide. The texts were laced with profanities, an obvious sign they were not genuine.
The ministry said the breach did not touch Russia’s wider public warning system, so no sirens or broadcast alerts went out, and promised the app would be fully restored by the end of Monday. Kremlin spokesman Dmitry Peskov did not address the incident directly, saying only that government websites, including the president’s, face cyberattacks around the clock.
Who was behind it
No government has formally assigned blame. A Russian Telegram channel with links to the security services said a group called Hitcore had claimed the Ukrainian breach, a claim that has not been independently verified. Cyber experts told the BBC the informal tone of the messages points to hacktivist groups that may sympathise with one side without being directed by either government. Herbert Lin, a cyber policy researcher at Stanford University, said it appeared to be the first such hack of an official Ukrainian information app, but probably not the last.
Why it matters
Air raid apps are a lifeline in a war now well into its fifth year, and a hijacked warning system could, in theory, send people into danger or teach them to ignore genuine threats. This time, the flood of messages in quick succession and in the wrong language gave the game away, and no widespread panic was reported in either country. Oleksander Merezhko, who heads the Ukrainian parliament’s foreign affairs committee, called it an unpleasant but expected part of cyber war. The Ukrainian alerts went out minutes before the end of a local ceasefire in the Kherson region that had been set up to let civilians leave Russian-occupied Oleshky.
