IMPLICATOR
The warning issued in Kyiv at approximately 22:47 local time on Sunday ran to two short sentences. "Radiation threat. Radiation threat declared in Kyiv."
The next message came at 22:48, written in Russian. "Hi! There will be a nuclear alert across Ukraine. Don't worry, it's Oreshnik flying." Oreshnik is a Russian intermediate-range ballistic missile capable of carrying nuclear or conventional warheads. Two more alerts at 22:49 warned of a chemical attack on Kyiv and of street fighting in the city. Both told people, "Don't go outside."
A few hours later, Russian authorities said their own app had been hacked.
Ukraine and Russia both say hackers compromised their emergency alert apps and used them to send fake warnings, including nuclear threats. Neither side's claims have been independently confirmed.
What Changed
- Ukraine and Russia both say hackers compromised their emergency alert apps and used them to send fake warnings, including nuclear threats.
- Neither side's claims have been independently confirmed, and it was not immediately clear whether the two incidents were linked.
- In the Lviv region, authorities reported that some public warning sirens and loudspeaker systems broadcast a radiation hazard signal.
- Russia's ministry of emergency situations said the hack did not impact the country's overall alert system.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
The Air Alert app
Millions of Ukrainians rely on the app for information about incoming Russian missile and drone strikes. It is supported by the Ministry of Digital Transformation of Ukraine. Shortly before 23:00 it sent red-level air raid warnings nation-wide, with the additional warnings going to some residents in areas including Kyiv.
The alarm did not stay on phones. In the Lviv region, authorities reported that some public warning sirens and loudspeaker systems broadcast a "radiation hazard" signal. "Even the speakers here in the centre of the city rang out warnings of these attacks," said Al Jazeera's Audrey Macalpine, reporting from Kyiv.
FREE WEEKDAY MORNING BRIEFING
Follow the cyberattacks on wartime alert systems.
The Implicator Morning Briefing filters the AI news cycle to the stories worth your attention and explains their consequences. From San Francisco, every weekday at 4:45 a.m. Pacific, 7:45 a.m. Eastern.
About five minutes. No hype. No spam.
Ukraine's Air Force said the app had likely been "compromised by the enemy" and that there was no radiation threat. The app's creators said "unauthorized third parties interfered with the operation of the app," which forced them to suspend it temporarily. They later called the incident a cyberattack and said the service was gradually being restored. At 23:53, all-clear messages reached users' phones, each one declaring one of the Kyiv threats over.
Several regional leaders posted on Telegram that the app had apparently been hacked and there was no local threat. "Everything is calm in the region for now," said Svitlana Onyshchuk, the head of the Ivano-Frankivsk region, where the app had reported a red-level air raid alert between 22:50 and 23:57. Natalya Zabolotna, the Vinnytsia regional head, warned people not to click on the link in the message, which could be a phishing attempt.
The reaction in Ukraine
Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament and a member of President Zelensky's Servant of the People party, told the BBC the attack didn't cause panic or extreme reaction. He said Ukrainians, especially in Kyiv, were used to "practically non-stop alerts." "Secondly, this message was in Russian language which immediately aroused suspicions," he said.
Ukraine's Center for Strategic Communications blamed Russia, pointing to the use of the Russian language in one of the fake messages.
Many Ukrainians shared memes online, poking fun at what they saw as a blatant fake. "They might as well have thrown in a dinosaur attack, too," one user wrote on X. Macalpine reported that the alerts startled a lot of people. "But most people here understood within at least half an hour that this was some kind of hacking attack," she said.
The Russian alert
Russia's ministry of emergency situations said its app had been subjected to "a massive cyberattack," which sent "fake information to the public." Ukrainian news outlet UNN reported the hack sent fake alerts of a nuclear threat inside Russia, citing Atesh, a partisan Ukrainian group operating inside Russian-held territory.
Know someone who'd find this useful? ✉️ Email it to a friend in one click, or they can subscribe free here.
A purported screenshot shared by Atesh on Telegram warned that "nuclear warheads mounted on P1-Suns," a Ukrainian attack drone, "had been launched at all regions of Russia." The alert, which included profanities, opened by telling residents there was a "risk of getting lively" and told them to "stock up urgently on food for three weeks and hide."
The ministry said the hack did not impact the country's overall alert system, which reaches citizens through sirens and loudspeakers, text messages, and TV and radio broadcasts. "The hacking of the mobile app has not had, and cannot have, any impact on the operation of the public alert system," it said on Telegram. It called the app "only an additional, ancillary news service." Russian authorities did not say who was to blame, only that "malicious actors" were behind it. It was not immediately clear whether the two incidents were linked.
Earlier attacks
This appears to be the first time either Ukraine's or Russia's official alert apps have been hacked. Russian hackers attacked Ukrainian government and banking sites in January 2022. In late 2023, the Russian hacker group Sandworm took the private telecommunications network Kyivstar offline, disrupting notifications for days. The volunteer-based IT Army of Ukraine has reportedly targeted the Moscow Stock Exchange, Russia's power grids and several government websites.
The Ukrainian alerts came just minutes before the end of a localized ceasefire in the front-line Kherson region, which officially ended at 23:00 on Sunday. The truce had allowed civilians to evacuate the Russian-occupied city of Oleshky.
Cybersecurity experts suggested the false alerts were a new line in apparent Russian cyberattacks. "I think it's the first time it's happened to an official Ukrainian information app, but I suspect it won't be the last," Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told BBC World Service's Newsday programme.
Frequently Asked Questions
What did the fake alerts in Ukraine say?
Starting at approximately 22:47 local time on Sunday, they warned of a radiation threat in Kyiv, a chemical attack and street fighting in the city. A message written in Russian said there would be a nuclear alert across Ukraine.
Who does Ukraine blame?
Ukraine's Center for Strategic Communications blamed Russia, pointing to the use of the Russian language in one of the fake messages. Ukraine's Air Force said the app had likely been compromised by the enemy. Neither side's claims have been independently confirmed.
What happened in Russia?
Russia's ministry of emergency situations said its app was subjected to a massive cyberattack that sent fake information to the public. A purported screenshot shared by Atesh, a partisan Ukrainian group, warned of nuclear warheads launched at all regions of Russia.
Did the alerts cause panic in Ukraine?
Oleksander Merezhko, chair of the Ukrainian parliament's foreign affairs committee, told the BBC the attack didn't cause panic or extreme reaction. Al Jazeera's Audrey Macalpine reported that the alerts startled a lot of people, and that most understood within at least half an hour that it was a hacking attack.
Has this happened before?
This appears to be the first time either Ukraine's or Russia's official alert apps have been hacked. In late 2023, the Russian hacker group Sandworm took the telecommunications network Kyivstar offline, disrupting notifications for days.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
Free AI briefing · Weekdays
The AI stories that matter, sourced and explained.
Join the Morning Briefing. It goes out every weekday at 4:45 a.m. Pacific, with later sends for the East Coast, Berlin and Tokyo.
Free when you sign up: The Paperclip Compendium, our tested guide to running AI agents.
Free. Unsubscribe in one click.
Marcus Schuler
Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai
