Hackers Hit Ukraine and Russia Alert Apps With Fake Nuclear and Radiation Warnings
Millions of Ukrainians got false alarms of a nuclear attack and street fighting in Kyiv, and Russia's Emergencies Ministry app told users in 33 regions to stock food and shelter in basements.
The emergency alert apps that Ukrainian and Russian civilians rely on to warn them of incoming missiles were hacked within hours of each other on Sunday night, pushing false warnings of radiation, chemical attacks and nuclear strikes to millions of phones, CBS News reported from Kyiv.
In Ukraine, the Air Alert app began sending the false messages at 10:47 p.m. local time, 3 p.m. Eastern. The alerts warned of radiation, chemical threats, a nuclear attack and street fighting in Kyiv. The app, developed by Ajax Systems and Stfalcon with support from Ukraine's Ministry of Digital Transformation, is widely used to decide whether to shelter during Russian missile and drone strikes. The notifications reportedly reached millions of people across the country.
About 15 minutes later, at 11:02 p.m., the Ukrainian Air Force said on several platforms that the alerts were false. Its Telegram message said the app "appears to have been subjected to hostile interference" and that there was "no radiation threat." Some Kyiv residents realized the alerts were fake only after checking Telegram channels, where the Air Force and security analysts post more detailed strike information. The developers said "unauthorized interference" had occurred and temporarily disabled push notifications and the app.
Yurii Ihnat, an Air Force spokesman, said the hack did not affect Ukraine's security operations and that the app is not connected to military command systems.
Hours later, at 2:45 a.m. Moscow time Monday, 6:45 p.m. Eastern on Sunday, Russia's Emergencies Ministry app was hacked. According to Russia's tightly controlled media, false alerts reached users in 33 regions. They warned of nuclear warheads being launched across the country, told residents to stock food for three weeks and advised them to shelter in basements. The ministry said attackers had exploited a vulnerability in the app's administrative panel, and officials disconnected and isolated the affected services.
Neither government has said who was responsible, and CBS News did not report a claim of responsibility. The two incidents followed different timelines but landed on the same night, one in which a temporary ceasefire in and around Oleshky, a southern Ukrainian city occupied by Russia since 2022, expired at 10:59 p.m. Ukraine time.
That truce began Oct. 27, and both sides credited U.S. First Lady Melania Trump and Pope Leo with brokering it. It allowed humanitarian aid into the city and let some civilians evacuate. Ukraine's human rights commissioner, Dmytro Lubinets, said both sides had observed the agreement and were discussing further humanitarian measures.
The attacks show how much civilians on both sides depend on a handful of phone apps in a war now in its fifth year. A false alert that sends people into shelters costs sleep and trust, and a false alert that is believed could prompt panic. In Kyiv, the fastest correction came from the Air Force's own posts, not from the app that sent the warning.
