In Ukraine, the “Air Alert” application, supported by the Ministry of Digital Transformation, began sending baseless red-level warnings to users across the country at approximately 10:45 p.m. Kyiv time (3:45 p.m. ET). The messages, which included severe grammatical and spelling errors in English as well as a mix of Russian and Ukrainian, warned residents of a “radiation threat” and “chemical threat” in Kyiv, urging them not to go outside. One particularly alarming message, written in Russian, claimed that “all of Ukraine was under nuclear alert” and referenced “Oreshnik,” the name of a Russian intermediate-range ballistic missile capable of carrying nuclear or conventional warheads.
Ukrainian authorities moved quickly to contain the incident. Shortly after the alerts began, the Ukrainian Air Force stated that the app had likely been “compromised by the enemy” and confirmed that there was no actual radiation threat. The developers of the app acknowledged that “unauthorized third parties interfered with the operation of the app,” forcing them to temporarily suspend its services. Ukraine’s State Emergency Service reported that the breach also triggered a radiation hazard signal on public warning sirens and loudspeaker systems in the western Lviv region, although officials clarified that no physical threat existed. By Monday, the national alert system was reported to be operating normally again, with the development team stating they were implementing additional measures to prevent similar incidents in the future.
The attribution of the attack remains a point of contention and lacks independent verification. One of the false alerts sent to Ukrainian users mentioned a hacking group called “Hitcore.” Mash, a Russian Telegram channel with reported links to Russian security services, claimed that representatives of Hitcore had asserted responsibility for the attack. However, this claim has not been independently confirmed. In a separate development, a Ukrainian espionage group claimed that fake warnings of nuclear strikes had also been sent to users in Russia, suggesting a possible exchange of cyber blows between the two sides.
Hours after Ukraine confirmed the breach, Russian authorities stated that their own emergency warnings app had been subjected to a “massive cyberattack.” The Russian Emergencies Ministry said hackers had posted “false information” on the mobile application, which is designed to warn the public of incoming drone attacks and other threats. Kremlin spokesperson Dmitry Peskov and other officials reassured the Russian public that the wider state alert system was functioning normally. They clarified that the mobile app serves as a supplementary service alongside other critical communication channels, including SMS messages, media broadcasts, and municipal sirens and loudspeakers.
Security experts noted that the compromise of the mobile application did not impact the core military defense operations of either country. Yurii Ihnat, a spokesman for Ukraine’s air force command, explained to 1+1 television that the app is separate from military command systems. He emphasized that the air force continues to report real-time threats through independent communication channels, including popular social media platforms, ensuring that the integrity of military intelligence and warning systems remained intact despite the digital breach.
The incident highlights the growing vulnerability of civilian digital infrastructure in modern conflict. For millions of Ukrainians, who have become accustomed to the unsettling buzz of air raid alerts, the false warnings were immediately recognizable as anomalous. Many residents shared memes online, poking fun at the blatant inaccuracies, such as the warning being issued in Russian. “No one was particularly surprised,” one user wrote on X, “They might as well have thrown in a dinosaur attack, too.” Nevertheless, the episode underscores the strategic risk of relying on single-point-of-failure digital systems for life-critical safety information, prompting authorities in both nations to re-evaluate the security of their alerting mechanisms.
The next confirmed development will be the full restoration of secure operations for both Ukraine’s “Air Alert” and Russia’s emergency app, along with any official regulatory or technical reports detailing the specific vulnerabilities exploited in the breaches.
