Residents in Ukraine and Russia received false warnings of nuclear strikes and other attacks on Sunday night after hackers compromised emergency alert apps in both countries.
In Ukraine, the widely used Air Alert app began issuing air raid warnings across the country shortly before 23:00 local time (21:00 GMT), followed by alerts warning of radiation hazards, chemical attacks, and street fighting in Kyiv.
One notification, sent at approximately 22:48, was written in Russian and warned users of an impending nuclear alert, adding: “Don’t worry, it’s Oreshnik flying.” Oreshnik is Russia’s intermediate-range ballistic missile, which can carry conventional or nuclear warheads.
Other messages warned residents not to leave their homes because of alleged chemical attacks and fighting in the streets. A series of all-clear notifications followed around an hour later.
Ukraine’s Air Force subsequently warned that the app had likely been compromised, stressing that there was no radiation threat. “The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel,” the Air Force said in a Telegram post seen by Resilience Media.
The app’s operators later confirmed that unauthorised individuals had interfered with the service, prompting them to disable push notifications and temporarily suspend its operation.
“The app does not store personal data, so there is no threat to users,” the operators said, warning people not to follow links contained in suspicious notifications.
Developed by Stfalcon in collaboration with Ajax Systems, with support from Ukraine’s Ministry of Digital Transformation, the Air Alert app warns residents of incoming attacks and other dangers. Millions of Ukrainians rely on the service, making the breach particularly concerning given the ongoing threat of Russian missile and drone strikes.
A few hours later, Russia’s Ministry of Emergency Situations reported a separate cyberattack against its own public warning app, which it said had been used to distribute false information.
According to Ukrainska Pravda, users in Russia received fabricated warnings claiming that Ukrainian drones carrying nuclear warheads had been launched towards Russian territory. The messages also urged residents to stockpile food for three weeks and seek shelter.
The Ukrainian partisan group Atesh reportedly claimed responsibility for the Russian incident, although its involvement has not been independently verified.
Russia described the incident as a “massive cyberattack” but said its wider public warning infrastructure remained operational. The ministry stressed that sirens, loudspeakers, text messages and television and radio broadcasts were unaffected.
Ukraine’s Centre for Strategic Communications blamed Russia for the attack on its app, although the technical details of the compromise have not been publicly established. It also remains unclear whether the two incidents were connected.
In a subsequent Telegram update, the Ukrainian app’s operators said they had begun gradually restoring the service, including push notifications and information about drone and missile threats.
The incidents followed a separate cyberattack on Russia’s state statistics agency, Rosstat. The Belarusian Cyber Partisans and Silent Crow hacking groups claimed to have stolen 23 terabytes of data, including information on Russian military losses in Ukraine. Rosstat confirmed that its systems had been targeted between 29 October and 1 November but denied that any data had been leaked.
