At 10:47 p.m. on Sunday, phones across Ukraine lit up with the kind of message nobody there wants to see. A nuclear alert had been declared for the entire country. There was a radiation threat in Kyiv. A chemical attack. Street fighting. One notification, written in Russian, told users not to worry because “an Oreshnik is overhead.”
None of it was real. The messages came through Air Alert, the app millions of Ukrainians use to decide whether to head for a shelter, and it had been hijacked. As UNILAD Tech reported, the app was taken offline after the false warnings. Then, a few hours later, the same thing happened on the other side of the front line: Russia’s own emergency alert app started telling people that nuclear warheads were on the way.
The short version
- Attackers pushed about 122 fake alerts through Ukraine’s Air Alert app in roughly seven minutes on November 1.
- The messages warned of radiation, a chemical attack, street fighting in Kyiv and an incoming Oreshnik missile.
- Ukraine’s Air Force called them false about 15 minutes after they started. The developer, Ajax Systems, shut the app down and restored it on Monday.
- Around 2:45 a.m. Moscow time, Russia’s Emergencies Ministry app sent fake nuclear warnings to users in 33 regions.
- Two different groups claimed the attacks. Neither government has named a culprit for its own breach, and no link between the two has been confirmed.
What Ukrainians saw on Sunday night
According to CBS News, the false notifications started at 10:47 p.m. local time. They covered Kyiv and several other regions, and some messages sent to cities like Kharkiv warned of urban combat and shelling. Users were told to stay indoors, put on protective equipment and take iodine tablets, which is the standard advice for a radiation emergency. That detail matters. Whoever wrote these alerts knew what a real one looks like.
The Oreshnik reference was chosen for the same reason. It’s a real Russian intermediate range ballistic missile that can carry a nuclear or conventional warhead, and Russia has fired it at Ukraine before. Naming it made the warning feel specific instead of random.
The Ukrainian Air Force moved fast. In a Telegram post, it wrote: “The air alert app appears to have been subjected to enemy influence. There is no radiation threat! Stay calm and follow our updates on our channel!” SPRAVDI, Ukraine’s Center for Strategic Communications, blamed Russia on X. Kyiv officials said the city’s separate alert app was working normally the whole time.
The scare didn’t stay inside the app, either. SOFX reported that some sirens and loudspeakers in the Lviv and Ivano-Frankivsk regions briefly played a radiation hazard signal before officials confirmed the national warning system itself was fine. The Ivano-Frankivsk governor told The Telegraph that the situation was calm and that reports pointed to “a cyberattack on the notification app.”
What Air Alert is, and why it was a target
Air Alert (Povitryana Tryvoha in Ukrainian) launched in March 2022, just weeks after Russia’s full scale invasion. It was built by Ukrainian security company Ajax Systems and developer Stfalcon with support from the Ministry of Digital Transformation. You pick your city or region, and the app sends a loud push notification when an air raid is declared there, plus an all clear when it ends. As of January, it had about 6.6 million users.
That reach is exactly what makes it valuable to an attacker. A message from Air Alert doesn’t feel like a rumor on social media. It feels official. Ukrainian Air Force spokesman Yurii Ihnat stressed that the app isn’t connected to the military’s command systems and that the hack had no effect on security operations. The damage was psychological, and it landed at night, when people are least able to check what’s real.
Ajax Systems said “unauthorized interference” had occurred, switched off push notifications and suspended the service before bringing it back on Monday. The company hasn’t published a technical explanation yet. A previously unknown group calling itself Hitcore Corp, which was linked inside the fake messages, claimed responsibility.
Then Russia’s app got the same treatment
About four hours after the first false alert in Ukraine, users of the Russian Emergencies Ministry (MChS) app received their own fake warnings. Russian state media said the messages claimed nuclear warheads had been launched at every region of the country, carried by Ukrainian P1-SUN drones, and told people to stock up on three weeks of food and shelter in basements. The ministry said messages reached 33 regions.
The ministry called it a “massive cyberattack” and said attackers had exploited a vulnerability in the app’s administrative panel. It also said the hack had not affected, and could not affect, the country’s main warning network of sirens, loudspeakers, text messages and broadcasts. A group calling itself DC8044, which describes itself as an independent Kyiv based cybersecurity community, said it carried out the Russian breach through the app’s programming interface.
The Russian messages had an obvious flaw. The P1-SUN is a small Ukrainian interceptor drone built to knock Russian attack drones out of the sky. It carries a warhead of about 1.75 pounds and has a range of just over 20 miles. It couldn’t carry a nuclear weapon, and it couldn’t reach most of Russia.
| Ukraine: Air Alert | Russia: MChS app | |
|---|---|---|
| When | 10:47 p.m. Sunday, Kyiv time | 2:45 a.m. Monday, Moscow time |
| Fake threat | Oreshnik missile, nuclear alert, radiation, chemical attack, street fighting | Nuclear warheads on Ukrainian P1-SUN drones |
| Instructions given | Stay inside, wear protective gear, take iodine, find a shelter | Stock up on food for three weeks, shelter in basements |
| Reach | App with about 6.6 million users | Users in 33 regions |
| Claimed by | Hitcore Corp | DC8044 |
| Official response | Air Force debunks on Telegram, app suspended, restored Monday | Ministry blames admin panel flaw, isolates services |
The timing is hard to ignore
Both hacks landed as a local ceasefire around Oleshky, a Russian occupied city in Ukraine’s Kherson region, came to an end. That truce started on October 27, was credited by both sides to U.S. first lady Melania Trump and Pope Leo, and allowed humanitarian aid in and some civilians out. It expired at 10:59 p.m. Ukraine time on Sunday, twelve minutes after the first fake alert went out. Al Jazeera described it as the longest ceasefire of the war so far.
Hijacked warning systems aren’t new in this war. In 2023, hackers broke into Russian commercial radio stations and broadcast fake air raid warnings telling listeners to head to shelters. Both countries have also hit each other’s digital infrastructure in more physical ways. Last month, for example, Ukrainian drones knocked out three Yandex data centers.
Fifteen minutes is fast. It still isn’t fast enough.
The best comparison for how a false alert plays out comes from the United States. On January 13, 2018, a worker at the Hawaii Emergency Management Agency sent a ballistic missile warning to every phone in the state by mistake. It ended with “THIS IS NOT A DRILL.” The official correction through the same alert system didn’t arrive for 38 minutes.
Ukraine’s Air Force needed about 15 minutes, and it helps that many Ukrainians already follow the Air Force and local monitoring channels on Telegram. Several Kyiv residents told CBS they knew the alerts were fake as soon as they checked. But 15 minutes is a long time when the message says a nuclear missile is overhead, and people who don’t follow those channels had nothing else to compare against.
The bigger lesson applies anywhere. Alert apps are a single point of trust. If an attacker gets into the admin panel or the push notification service, every message they send carries the app’s credibility with it. Governments run official broadcast systems like Wireless Emergency Alerts for that reason, and they work separately from third party apps.
1. Look for a second source …… official agency account, local news, radio
2. Check the language ………… wrong language or odd wording is a red flag
3. Check what it asks you to do .. does it match official guidance?
4. Don’t forward it yet ……….. sharing spreads the panic further
5. Keep official alerts ON ……… government broadcasts are separate from apps
That last point is worth a minute of your time even if you live far from a war zone. Both iPhone and Android let you toggle government alerts on or off, and plenty of people turn them off after one too many test messages. We walked through where to find those settings in our guide to checking your phone’s emergency alerts.
Sources and further reading
- UNILAD Tech: Ukraine’s emergency app taken offline after users receive false nuclear attack warnings
- CBS News: Ukraine and Russia’s emergency alert apps both hacked
- Al Jazeera: Russia, Ukraine air raid alert apps hit by cyberattacks after truce ends
- Cybernews: Air alert apps hacked to send fake nuclear warnings
- SOFX: Cyberattacks strike Ukrainian and Russian emergency apps with false nuclear alerts
- The Telegraph: Ukraine alert app false nuclear warning
- NPR: FCC on Hawaii’s false missile alert and the 38-minute delay
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
