Hackers took over Ukraine’s most popular air-raid warning app on Sunday night, November 1. The Air Alert app hack pushed fake warnings of radiation, a chemical attack and street fighting in Kyiv. Within hours, Russia said its own emergency app had sent a false nuclear-strike warning to 33 regions.
Officials reported no injuries, and both governments said their sirens kept working. The more useful detail is where the attackers got in. In both countries, the evidence points to the consoles that send alerts, not the phones that get them. That is also where the known risks in America’s alert system sit.
What Ukrainians saw on their phones
The fake alerts arrived in Russian on Sunday evening. One read, “There is a radiation hazard alert in Kyiv. Do not go outside!” according to Fox News.
Another warned of a chemical attack in the capital. The app’s public map showed Kyiv and other areas under a nuclear alert.
A third message, quoted by The National, mocked its readers: “Hi! There will be a nuclear alert across Ukraine. Don’t worry, it’s Oreshnik flying.” Oreshnik is Russia’s hypersonic missile.
Ukraine’s Air Force said on Telegram that the app “appears to have been subjected to enemy influence.” It added, “There is no radiation threat!” Al Jazeera reported. The Kyiv Independent said the false alerts cleared about an hour after they began.
The developers said “unauthorized persons have interfered with the application.” They switched off push notifications and paused the service. They began restoring it at about 2 a.m., and said the app “does not store or use personal data, so there is no threat to users.”
By Monday, alerts and the map’s threat levels were back. The map’s display of individual missiles and drones stayed off, dev.ua reported.
Why one console could reach millions
Two Ukrainian firms, Stfalcon and Ajax Systems, built Air Alert with the digital ministry in March 2022. Stfalcon’s project page counts 26 million downloads and more than 6 million users.
The same page explains how alerts get in. Operators at regional administrations receive the air-raid signal and type it into a console. The app then notifies everyone who picked that area. Stfalcon calls the app an extra channel and tells users to keep listening for sirens.
That design explains the scale. Nobody had to break into millions of phones. Whoever controlled the sending side could reach all of them at once.
The digital ministry said street sirens worked normally, KP.ua reported. It urged people to switch on their phones’ built-in emergency alerts. Vinnytsia’s governor, Natalia Zabolotna, told residents not to click links in the messages, since the attack might involve phishing.
Russia’s emergency app was hit hours later
At about 2:45 a.m. Moscow time on Monday, Russia’s Emergencies Ministry app sent a false message to 33 regions. The ministry said attackers broke into the app’s administration panel, according to URA.news. Staff then cut the services off from the network and deleted the false posts from official channels on the Max messenger.
The ministry called it a “massive cyberattack” that let attackers spread fake information, Interfax reported. Russia’s National Coordination Center for Computer Incidents will look into the cause. The ministry expected to restore the app fully during the day.
The fake alert claimed Ukraine had launched nuclear warheads on “P1-SUN” drones at every Russian region, The National reported. The Russian outlet Lenta.ru said the messages also told people to stock three weeks of food and hide in basements.
The ministry stressed that sirens, loudspeakers, texts, TV and radio remain its main warning channels. It called the app a supporting tool, Regnum reported.
Who is claiming responsibility, and what is unproven
Each side’s claims stand on their own, and neither has published technical evidence.
Ukraine’s Center for Strategic Communications blamed Russia for the Air Alert breach in a post on X. Oleksandr Merezhko chairs the Ukrainian parliament’s foreign affairs committee. He told the BBC the messages raised suspicion because they were in Russian, The National reported. He called the hack “part of cyber war.”
A group calling itself Hitcore claims it hacked the Ukrainian app. It told the Russian Telegram channel Mash that it sent an app administrator malware disguised as an explicit photo, according to Lenta.ru. KP.ua reported the group’s claim that it then inserted fake alerts with links to Russian Telegram channels. No Ukrainian official has confirmed or denied that account, and nobody has verified it independently.
On the Russian breach, the Emergencies Ministry has not named a culprit. We found no public claim of responsibility, and the Ukrainian outlet Militarnyi called the attackers unidentified. Nothing on the record links the two incidents.
The timing has drawn attention. A six-day local ceasefire around Oleshky, a Russian-occupied city in Ukraine’s Kherson region, expired at midnight Moscow time on Sunday, The National reported. In October the White House said first lady Melania Trump had brokered that truce for aid and evacuations, the Associated Press reported. No official has tied its end to either hack.
The US weak point is also the sender
American phones get emergency alerts through FEMA’s Integrated Public Alert and Warning System. Approved state and local agencies write the messages. The system checks them and passes them to cell carriers, broadcasters and NOAA Weather Radio. As in Ukraine, the public sees whatever an approved sender puts in.
The US has seen that go wrong without any hacker. On January 13, 2018, a Hawaii worker sent a false ballistic-missile alert at 8:07 a.m. The correction went out at 8:45 a.m., 38 minutes later. FCC investigators blamed human error and weak safeguards, KUT reported.
Attacks on the sending gear are a known risk too. In August 2022, FEMA warned that unpatched alert encoders could let an attacker “issue EAS alerts over the host infrastructure (TV, radio, cable network).” It told stations to patch, firewall and monitor the devices, BleepingComputer reported.
This weekend showed that risk in a war, where a false alert can send people into shelters or keep them out. It fits the logic behind Britain’s push for household emergency kits: no single channel should carry all the trust. Our Black October hacks explainer covers how attackers get in through one person’s computer.
Next, watch for Ukraine’s account of how attackers reached the Air Alert console and the return of the app’s target map. In Russia, the computer-incident center’s findings on the Emergencies Ministry breach are still to come.
.jpg){kind=link}
