Hackers hijacked Ukraine's and Russia's emergency alert apps to send fake nuclear warnings
Ukraine's Air Alert app pushed fake radiation and nuclear warnings Sunday night. Then Russia said its emergency app was hacked too.
The skim
- Late Sunday, Ukraine's official "Air Alert" app pushed fake warnings of radiation, chemical attacks, street fighting and a nationwide nuclear alert. Hours later, Russia said its emergencies ministry app had been hacked too.
- Both governments called the incidents cyberattacks and say service is back or being restored. Neither has named who did it, and it isn't clear whether the two hacks are linked.
- The fakes were easy to spot: some of Ukraine's were written in Russian, and Russia's included profanity. The bigger risk is what happens to trust in the next real alert.
What happened
Around 10:45 p.m. Kyiv time on Sunday, Ukrainians' phones started buzzing with alerts warning them not to go outside because of a radiation hazard, a chemical threat and street fighting, NBC News reports. Another message, in Russian, claimed all of Ukraine was under nuclear alert. "Don't worry," it added. "Oreshnik is in action," a reference to Russia's nuclear-capable hypersonic missile.
Ukraine's air force moved fast. "The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel," it said on Telegram, according to the BBC. The app's developers said "unauthorized third parties interfered with the operation of the app," suspended it, and later called the incident a cyberattack and restored service. All-clear messages followed each fake alert, and Ukraine's digital ministry said other warning channels, including air raid sirens, were still working, Reuters reported.
It wasn't only phones. Authorities in western Ukraine's Lviv region said some public sirens and loudspeakers broadcast a "radiation hazard" signal, NBC reports.
A few hours later, Russia's Ministry of Emergency Situations said its own mobile app had suffered a "massive cyberattack" resulting in the "dissemination of fake information to the public." Screenshots showed a message, laced with profanity, claiming nuclear warheads had been launched at every Russian region and telling people to stock up on three weeks of food and hide. The ministry stressed that the app is only "an additional, supplementary information service."
Who's behind it
Nobody has been confirmed. Ukraine's fake alert referenced a Telegram channel called Hitcorecorp, and the pro-Kremlin channel Mash said the group claimed responsibility. NBC says it couldn't verify that. In Russia, the pro-Ukrainian partisan group Atesh posted a screenshot of the fake alert on Telegram, and Russian officials blamed only "malicious actors."
Cyber experts told the BBC the informal wording points to hacktivists, groups that may sympathize with Moscow or Kyiv without being directed by either government.
The timing stood out: the alerts landed just as a six-day local ceasefire in the Kherson region expired. The truce, brokered with the involvement of First Lady Melania Trump, allowed civilians to evacuate the Russian-occupied town of Oleshky. "On behalf of America, I commend Russia and Ukraine for their leadership and cooperation surrounding the Oleshky ceasefire," the first lady said on X on Sunday, adding that she hopes it "serves as a foundation for lasting peace between both nations." She said nearly 800 people were evacuated.
Why it matters
For millions of Ukrainians, the alert app is how they know when to take shelter from missiles and drones. This attack mostly fizzled because it was so obviously fake, and many Ukrainians shared memes mocking it. A more convincing version could do real harm, or train people to ignore the warnings that matter.
"I think it's the first time it's happened to an official Ukrainian information app, but I suspect it won't be the last," Stanford cyber policy scholar Herbert Lin told the BBC.
What's next
Ukraine's emergency service said Monday the national alert system was operating normally, and the app's developers say they're adding protections to prevent a repeat. Russia's emergencies ministry said its app would be fully restored by the end of Monday. Neither side has said how the attackers got in.
