The Kyiv Independent said hackers broke into its website management system and a newsletter distribution service on Wednesday and sent subscribers false emails claiming a nuclear warhead had been launched at Kyiv. The outlet suspects a Russian operation, though it has offered no technical evidence for that attribution.
False Emails Claimed Zelensky Launched a Nuclear Warhead at Kyiv
The intruders published false messages on the site and emailed subscribers in Russian and English. One message falsely claimed that President Volodymyr Zelensky launched a nuclear warhead at Kyiv as a “proof of friendship” after meeting Vladimir Putin, and urged recipients to take shelter. It included a link to an anonymous Telegram channel. Other messages claimed a physical attack on Zelensky.
The outlet removed the messages posted to its website. Writing in both Russian and English widened the pool of recipients who could read the false claims, and the claim of a physical attack on Zelensky gave the campaign a second false storyline alongside the nuclear one. The Kyiv Independent draws about 3 million monthly readers and has more than 35,000 paying members.
Kyiv Independent’s Russia Attribution Rests on Message Content Alone
The outlet attributes the attack to Russia on the basis of what the messages said. It has provided no technical evidence, such as infrastructure indicators or malware, to support the link. The attack is the first of this kind the outlet has experienced.
Intruders Reached Two Kyiv Independent Systems That Control What Readers See
Access to a website management system lets an attacker publish content under the outlet’s own name, and access to a newsletter service puts messages directly into subscribers’ inboxes. Both channels carry the trust of an established news brand, which is what gave the fake nuclear-strike claim its potential to alarm recipients.
Member and donor banking data was not compromised. The outlet says payments run through third-party services rather than its own systems.
Kyiv Independent Staff Work With Specialists to Close the Gaps
The Kyiv Independent’s chief operating officer, Zakhar Protsiuk, said staff are working with cybersecurity specialists to find vulnerabilities and prevent further intrusions. The outlet has not described how the attackers obtained access to either system or how long they held it.
A Similar Telegram-Linked Hit Preceded It on Ukraine’s Air-Raid Alert App
Days earlier, hackers targeted Ukraine’s air-raid alert app with fake nuclear and chemical warnings. Those alerts directed users to a Telegram channel belonging to a group calling itself Hitcore Corp. No confirmed link exists between that incident and the Kyiv Independent attack.
Kyiv Independent and Air-Raid App Attacks Both Redirect to Telegram
The two incidents share a pattern in the reported details. Each delivered a false threat of mass-casualty attack through a channel people rely on for urgent information, and each pointed recipients toward a Telegram channel. The shared pattern does not establish a common operator, and the Kyiv Independent attack involved a news outlet’s publishing and email systems rather than a government-run alert service.
The use of nuclear-strike claims aims at immediate panic rather than gradual persuasion. Because an alert in an emergency app and an email from a trusted newsroom each appear authoritative to the person receiving them, intrusions into either type of system can generate harm before an organization has a chance to issue a correction. Attribution to a state actor remains unconfirmed, and the outlet’s investigation with outside specialists is continuing.
The outlet’s account names two distinct systems, the website management system and the newsletter distribution service. It has not said whether the attackers obtained access to both separately or moved from one to the other, and it has not disclosed the method or duration of the intrusion.
