Listen to the article
Emergency alert applications used by millions of civilians in Ukraine and Russia were hacked in quick succession over Sunday night and Monday morning, sending fabricated warnings of nuclear radiation, chemical threats and incoming missile strikes before authorities in both countries issued corrections.
Ukraine’s Air Force said late on Sunday that users of its Air Alert app — the country’s primary system for warning of incoming air attacks — received fake notifications of nuclear and chemical threats to areas in and around Kyiv. The false messages also warned of potential street combat and claimed that Russia’s hypersonic Oreshnik missile had been deployed. “The air alert app appears to have been subjected to enemy influence,” the Ukrainian Air Force said on Telegram. “There is no radiation threat! Stay calm and follow our updates on our channel.”
The alerts arrived just after 10 p.m. local time and triggered loudspeakers in central Kyiv. Al Jazeera’s correspondent in the capital, Audrey Macalpine, reported that most residents understood within roughly half an hour that the warnings were the result of a cyberattack. Ukrainian authorities said a separate app created specifically for Kyiv was functioning normally throughout the incident.
Ukraine’s Center for Strategic Communications blamed Russia, pointing in a post on X to the use of the Russian language in at least one of the fake messages.
Russia’s system hit hours later
Hours after the Ukrainian incident, Russia’s Ministry of Civil Defence, Emergencies and Disaster Relief announced that its own warnings app had come under what it described as a “massive cyberattack,” causing the system to push false alerts about imminent drone strikes. The ministry did not name any suspects but said the notifications spread “false information.” Media reports said the fake messages told Russians that “nuclear warheads mounted on P1-Suns [Ukrainian drones] had been launched on all regions” of the country and instructed people to stock up on three weeks of food and seek shelter immediately.
Each side has accused the other of responsibility, framing the incidents as an escalation of digital and psychological warfare. This appears to be the first time either country’s official civilian alert apps have been successfully compromised in this way, though cyberattacks have been a persistent feature of the conflict since well before Russia’s full-scale invasion in February 2022.
Timing follows end of Kherson ceasefire
The fake alerts began on the same day a localised ceasefire in the Russian-occupied Kherson region expired. The truce, which the United States said was brokered by first lady Melania Trump, lasted six days — the longest pause in the more than four-year war — and allowed humanitarian aid deliveries and evacuations in the Russian-occupied town of Oleshky. Macalpine reported that many people in Ukraine now expect renewed fighting along the front lines following the ceasefire’s end.
A long history of mutual cyberattacks
Both countries have extensive records of offensive cyber operations. Russian hackers attacked Ukrainian government and banking websites in January 2022, and in late 2023 the Russian group Sandworm took the private telecommunications network Kyivstar offline, disrupting notifications for several days. Ukraine’s volunteer-based IT Army, founded specifically to conduct cyberwarfare against Russia after the invasion, has reportedly targeted the Moscow Stock Exchange, Russian power grids and multiple government websites.
The radiation angle carries particular weight in Ukraine. The 1986 explosion at the Chornobyl nuclear power plant, in what was then the Ukrainian Soviet Republic, released radioactive material detectable as far away as Sweden and left thousands with severe health consequences including thyroid cancer. Ongoing fighting in the Zaporizhia region has raised fears of a repeat: Russia partly controls the area, including Enerhodar, where the Zaporizhzhia Nuclear Power Plant — Europe’s largest nuclear facility — is located. Last week the International Atomic Energy Agency reported that a welder at the plant was killed in a drone attack, prompting IAEA chief Rafael Grossi to call for “maximum military restraint” from both sides.