The emergency alert apps of both Ukraine and Russia were hacked within hours of each other, pushing fake warnings about nuclear strikes, chemical attacks and missiles to citizens. Both governments said their national warning systems were not affected, and no group has been publicly identified.
Ukraine’s Air Alert App Pushed Fake Radiation and Chemical Warnings
Ukraine’s Air Force said around 2100 UTC on Sunday that its alert app was “likely compromised” and that there was no radiation threat. The fake notifications cited street fights in Kyiv, chemical attacks and radiation hazards. An early message was written in Russian and referenced the “Oreshnik” missile.
Ukraine’s Ministry of Digital Affairs reminded citizens to rely on phone emergency alerts and official sirens while the app was down.
Timing Coincided With the End of a Kherson Ceasefire
The alerts began almost at the same moment a six-day ceasefire in Kherson ended, at around 2100 UTC. Ukrainian MP Oleksander Merezhko told the BBC that the incident was almost certainly part of Russia’s cyber war. That assessment is a political judgment rather than a technical attribution, and no evidence tying a specific actor to the intrusion has been published.
Russia’s Ministry of Emergency Situations Confirms a Massive Cyberattack
About 0030 UTC on Monday, Russia’s Ministry of Emergency Situations confirmed a “massive cyberattack” on its mobile app, saying the intrusion allowed fake information to be sent. The alerts warned of nuclear strikes “at all regions of Russia” and mentioned “P1-Sun,” the name of a Ukrainian attack drone.
The ministry said the app was working normally about 90 minutes later. It stressed that the national alert system, made up of sirens, SMS, television and radio, was not compromised.
Russia Says It Is Patching the Vulnerability
Both governments issued statements pointing citizens to official channels, and Russia said it was patching the vulnerability. It did not describe the flaw or how the attackers reached the app’s messaging function. Russia has not explicitly blamed Ukraine for the attack.
Air Alert and Russian Ministry App Hacks Targeted Public Fear
The two incidents share a method: attackers gained the ability to send messages through a trusted government channel, and the content was written to cause fear rather than to damage systems. A push notification from an official app arrives with the authority of the sender, which is why a short false message about radiation or nuclear strikes can reach large numbers of people in minutes.
The separation between app and national system limited the damage on both sides. Sirens, SMS broadcasts, television and radio remained intact, and officials could point citizens to them. That layered design gives governments a fallback when a single channel is subverted, though it requires the public to know which channels to trust.
No Group Has Claimed the Alert App Hacks
The simultaneous timing across two countries invites speculation about coordination, but the reporting does not establish whether one actor attacked both apps or whether two separate parties acted. Ukraine’s alerts ran from about 2100 UTC and Russia’s from about 0030 UTC, a gap of several hours, and the content of each reflected the other side’s perceived threats.
How the attackers obtained message-sending access in either case has not been disclosed. Russia’s remark about patching a vulnerability suggests a software flaw rather than stolen credentials, though no details were given. Until either government releases a technical account, the incidents remain unattributed, and the content of the fake alerts is the main evidence of intent.
Neither Russia Nor Ukraine Has Described How the Apps Were Breached
Neither ministry has described the method used. Ukraine’s Air Force said only that the app was likely compromised, while Russia’s ministry said a vulnerability was being patched. The short length of both statements, combined with the lack of any claim of responsibility, means the public record consists mainly of the fake messages themselves and the official denials of any threat. Both countries moved quickly to tell the public that the radiation, chemical and nuclear warnings sent through the apps were false.
