KYIV — Hackers hijacked the emergency alert apps that millions of people in Ukraine and Russia rely on for warnings of air strikes, sending out false alerts about nuclear attacks late on Sunday and in the early hours of Monday, according to the Associated Press and Reuters.
In Ukraine, the false messages began at about 10:47 p.m. Kyiv time on Sunday on the Air Alert app. One message, in Ukrainian, declared a radiation threat in Kyiv. A second, written in Russian, said a nuclear alert would be issued across Ukraine and referred to Russia’s Oreshnik ballistic missile. Further messages warned of a chemical attack and street fighting in the capital and told people not to go outside. Ukraine’s Air Force said on Telegram that the app had probably been subjected to hostile interference and stressed that there was no radiation threat.
The app, supported by Ukraine’s Ministry of Digital Transformation and developed with the security technology firm Ajax Systems, is used across the country to warn people in real time of incoming Russian missile and drone attacks, often giving them only minutes to reach shelter. Its operators disabled push notifications and temporarily suspended the service, then began restoring it in stages. They said the app does not store personal data, so users faced no data breach. In the western Lviv region, a radiation hazard signal was briefly played on loudspeakers because of the app, and officials in Vinnytsia region warned people not to click a link in the messages.
About four hours later, at around 2:45 a.m. Moscow time on Monday, Russia’s Ministry of Emergency Situations said its own mobile app had been hit by what it called a "massive cyberattack." False alerts reached 33 of Russia’s 89 regions, claiming that nuclear warheads carried by Ukrainian drones had been launched and telling residents to stockpile food for three weeks and shelter in basements. The ministry said the attack had not affected, and could not affect, the main warning network of sirens, loudspeakers, text messages and broadcasts.
The nuclear claim in the Russian alerts did not hold up on its own terms: the drone named in the messages is a small interceptor built to bring down Russian attack drones, with a warhead of under two pounds and a range of just over 20 miles. It was not clear whether the two attacks were related, the Associated Press reported. A Russian Telegram channel said a hacking group had claimed responsibility for the breach of the Ukrainian system, and a Kyiv-based cybersecurity community said it carried out the Russian breach; neither claim could be independently verified.
President Volodymyr Zelenskyy told the U.S. broadcaster PBS on Monday that the attack on Russia’s system was a response to the attack on Ukraine’s, saying Ukraine only responds to Russian attacks, according to AAP reporting. Air Force spokesman Yurii Ihnat said the hack had no impact on Ukraine’s security and defense operations because the alert app is separate from military command systems. The incident shows how a tool built to keep civilians safe can itself become a target: a false alert can cause panic, and a real one ignored after a hack can cost lives.
