Ukraine's air raid alert app was hacked Sunday with fake radiation and chemical threat warnings. Hours later, Russia reported its emergency app was also compromised.
By Adam Makins·
In a dramatic display of digital warfare, both Ukraine and Russia reported their emergency alert applications were hacked on Sunday night, sending false alarms across both nations and raising fresh questions about the vulnerability of critical infrastructure during wartime.
Ukraine’s Air Alert app, a crucial tool for warning citizens of incoming Russian strikes, suddenly flooded users with alarming messages starting around 22:47 local time. The first alert declared a radiation threat in Kyiv. Subsequent warnings in quick succession claimed chemical attacks were imminent and that street fighting was occurring in the capital. Each message urged residents not to go outside, creating widespread panic during an already tense evening.
The Ukrainian Air Force quickly moved to calm fears, posting on Telegram that the app had been “subjected to hostile interference” and urging people to disregard the warnings. The Ukrainian Central Intelligence Agency confirmed the app had suffered a failure and recommended citizens rely on official channels for accurate threat information instead.
What happened next suggests this wasn’t a one-sided attack. Just hours after Ukraine’s alerts, Russian authorities claimed their emergency situations ministry app had been hit by a “massive cyberattack” spreading false information to the public. Ukrainian news outlets reported the hack sent fake nuclear strike warnings throughout Russia.
Atesh, a Ukrainian partisan group operating in Russian-controlled territory, quickly claimed responsibility for the Russian hack on Telegram, accompanied by laughing emojis. A screenshot they shared showed alerts urging Russians to stockpile provisions for three weeks and seek shelter in basements. The BBC has not independently verified these images.
The timing was particularly sensitive. These fake alerts occurred just minutes before a ceasefire ended in Ukraine’s Kherson region, which had been implemented to allow civilian evacuations from the Russian-occupied city of Oleshky.
The incident reveals a troubling vulnerability in how modern democracies and warring nations communicate with their populations during emergencies. When citizens can’t trust the apps designed to keep them safe, panic spreads faster than any accurate information can contain it.
Ukraine’s Ministry of Digital Transformation responded by temporarily disabling the Air Alert app for maintenance after confirming it had been compromised. They urged residents to enable emergency notifications on their smartphones and pay attention to air raid sirens instead. Regional governors across Ukraine posted individual reassurances on Telegram that their areas faced no actual threats.
Several officials specifically warned residents not to click links in the fake messages, suggesting these attacks may have doubled as phishing attempts to steal personal data or deploy malware.
The choice to send radiation and chemical threat warnings holds particular significance given Russia’s nuclear arsenal. President Vladimir Putin has repeatedly hinted at willingness to deploy all weapons at his disposal, making any false nuclear alerts especially destabilizing. Even knowing the alerts were fake, Ukrainians and Russians alike experienced genuine fear about the possibility of weapons of mass destruction being used.
This vulnerability extends beyond just news cycles and public panic. It demonstrates how cyberwarfare can undermine trust in critical systems that protect civilian populations. In an active conflict zone, the inability to distinguish genuine emergency alerts from hacked ones creates deadly confusion.
Ukraine’s Centre for Countering Disinformation advises the public to verify alerts through multiple sources and to turn on smartphone notifications from official state channels. It’s advice born from harsh necessity rather than abundance of caution.
The Russian full-scale invasion that began in February 2022 has already tested Ukraine’s infrastructure extensively, but cyberattacks on emergency systems represent a particularly insidious threat. They create doubt at the exact moment when clarity is most desperately needed, turning the tools meant to save lives into vectors for fear and misinformation.
Both nations will likely review their cybersecurity protocols for critical alert systems, though whether any improvements can truly prevent determined actors from penetrating these networks remains an open question that keeps security officials awake at night.
Source: BBC
