Hackers Hijack Emergency Alert Apps in Ukraine and Russia to Send Fake Nuclear Attack Warnings

Hackers targeted emergency alert apps in Ukraine and Russia late on November 1 and into November 2, sending false warnings about radiation, chemical threats, and nuclear strikes.

The incidents disrupted trusted public safety channels during wartime. However, officials said the app breaches did not disable their wider warning systems. No independent report has linked either attack to a named hacking group.

Ukraine’s Air Alert app began sending false notifications late Sunday, including warnings of dangerous radiation levels in Kyiv. Other messages claimed chemical threats and street fighting.

Some appeared in English with spelling and grammar errors. In contrast, others mixed Russian and Ukrainian, according to Associated Press reporting published by ITV News.

Hackers Hijack Emergency Alert Apps

Ukraine’s Air Force told residents there was no radiation threat. The app’s operators said unauthorized parties had interfered with the service, prompting them to turn off push notifications and temporarily suspend operations. Officials warned users not to open links in suspicious notifications and directed them toward other official information channels.

The app, developed through cooperation between Ukraine’s Digital Transformation Ministry and security company Ajax Systems, delivers warnings that help civilians seek shelter.

Officials said service was restored overnight. Air Force spokesman Yurii Ihnat stressed that the breach did not affect military operations because the app is separate from military command systems.

Hours later, Russia’s Emergencies Ministry reported a “massive cyberattack” against its mobile application. Attackers used the access to distribute false public warnings.

The Kyiv Independent reported that messages claimed nuclear warheads had been launched across Russia and urged people to shelter in basements and gather food for three weeks.

According to Euronews, Russian officials are working to fix the vulnerability and restore app services, while confirming that other warning channels, including SMS, broadcasts, sirens and loudspeakers, remain operational. The ministry did not identify the attackers.

Public reports establish that attackers could send unauthorized messages, but they do not explain how they gained access. The cited reporting disclosed no confirmed entry point, affected software version, or vulnerability identifier. Claims involving stolen passwords, malware or a specific software flaw would therefore be premature.

Ukraine’s Center for Strategic Communications blamed Russia for the Ukrainian incident, but that claim has not been independently confirmed. The close timing also does not prove the Russian app breach was retaliation or that both attacks shared an operator.

The incidents follow earlier threats to Ukrainian services. Cybersecurity News previously covered Russian hackers inside Kyivstar’s network and charges against six Russian nationals over attacks on Ukrainian government networks. Neither report establishes a connection to these app breaches.

For residents, the immediate concern was trust in urgent warnings. Ukrainian authorities urged people to monitor official emergency channels and physical alerts while recovery continued. The response underscored the importance of maintaining multiple ways to deliver life-saving information when one digital service is compromised.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.