False Emergency Alerts Hit Russia and Ukraine After Warning Apps Are Hacked

Within hours of each other, the emergency warning apps that millions of people in Russia and Ukraine rely on for air-raid alerts were compromised, sending false warnings about radiation, chemical attacks and nuclear strikes to phones across both countries. Neither threat was real. But the twin incidents, on the night of 1–2 November, exposed how fragile the digital systems that warn civilians of bombardment have become — and how quickly a false alarm can travel when the channel itself is trusted.

The first incident came on the evening of Sunday, 1 November, in Ukraine. Users of the Air Alert app — known in Ukrainian as “Povitriana tryvoha” and built by the company Ajax Systems — received warnings of radiation and chemical threats, street fighting and the deployment of Russia's Oreshnik hypersonic missile, according to reports of the incident. The Ukrainian Air Force said on Telegram that the app “appears to have come under enemy influence” and urged residents to remain calm, stressing: “There is no radiation threat.” Ukraine's Centre for Strategic Communications, known as SPRAVDI, publicly attributed the breach to Russian actors, an allegation that has not been independently established. The Ministry of Digital Transformation later said the nationwide alert system was functioning normally, and officials stressed that other notification channels, including air-raid sirens, remained operational. The false notifications were subsequently removed, although the incident prompted temporary restrictions on some app functions while technical teams worked to restore reliable alerts.

Hours later, overnight into Monday, 2 November, it was Russia's turn. The Emergencies Ministry said on Telegram that its mobile application had suffered a “massive cyberattack” that allowed attackers to exploit a security vulnerability and distribute false information to the public. According to the Russian outlet ASTRA, picked up by Ukrainian media, one false message said nuclear warheads had been launched and were aimed at every Russian region, telling people to stock up on three weeks of food and take shelter in basements; other accounts describe the wording differently, referring to warheads mounted on Ukrainian drones. The exact wording therefore varies between sources, and the ministry itself did not identify the messages, the number of recipients, the attack method or the suspected perpetrators. It said specialised technical teams were working to eliminate the vulnerability and restore the app's normal operation, and that Russia's broader public warning system was operating normally and had not been affected, with warnings continuing through regional and municipal sirens, loudspeakers, SMS, television and radio.

What makes the two incidents so unsettling is the role these apps play. The Ukrainian app separates chemical and radiological threat alerts from ordinary air-raid warnings and is how many Ukrainians receive sirens on their phones; the Russian Emergencies Ministry app does the same job for drone attacks and other dangers. In both countries, the app is an additional channel, not the whole warning infrastructure — officials on both sides were quick to point that out — but it is the channel many people check first, in the middle of the night, when a phone buzzes. A false warning of a radiation threat, or of nuclear warheads inbound, does not need to be believed for long to cause panic, unnecessary movement to shelters, and, critically, doubt the next time a genuine alert arrives.

Neither government has publicly established who was responsible for both incidents, and there is no confirmation that the attacks were connected. Moscow did not say who it believed was responsible for the attack on its own application. Kyiv's attribution of its breach to Russia remains an allegation by Ukrainian officials, not an independently verified finding. The incidents followed the end of a brief, localised ceasefire in Ukraine's southern Kherson region, arranged to allow a humanitarian mission in the Russian-occupied city of Oleshky, but no evidence has been presented linking the ceasefire's expiry to the app compromises. False air-raid alerts have precedent: in February 2023, unidentified hackers breached broadcasts of several local Russian radio and television stations and set off false air-raid alerts across multiple regions, as the Moscow Times reconstructed at the time.

For civilians on both sides, the practical advice from officials was the same: verify an alarming app message through more than one official source before acting on it, and follow confirmed instructions from sirens, SMS and broadcast alerts. For the authorities, the work now is technical and reputational at once — closing the vulnerabilities that allowed the false messages through, and restoring confidence in the systems that must be believed instantly when a real threat comes. In a war in which warnings arrive on a phone screen, trust in that screen is itself part of civil defence. On Sunday night and Monday morning, in two countries at once, that trust was shaken.