Air raid alert apps in Ukraine and Russia were hit by cyberattacks sending false nuclear threat warnings as a localized ceasefire expired

Air raid alert apps in both Ukraine and Russia were hit by cyberattacks that pushed false nuclear threat warnings to civilians, just as a localized wartime ceasefire in the Russian-occupied Kherson region was expiring.

The Ukrainian Air Force confirmed the hack on Telegram, writing: “The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” The Air Force did not name a perpetrator. SPRAVDI, Ukraine’s Centre for Strategic Communications, separately blamed Russia for the hack in a post on X. The Air Alert app, supported by Ukraine’s Ministry of Digital Transformation, was temporarily disabled for maintenance after being “apparently compromised.”

A barrage of false alerts

The false alerts in Ukraine started at approximately 22:47 (20:47 GMT), with red-level air raids apparently issued nationwide. The first alert read: “Radiation threat. Radiation threat declared in Kyiv.” A second message at 22:48, written in Russian, read: “Hi! There will be a nuclear alert across Ukraine. Don’t worry, it’s Oreshnik flying.” A third alert at 22:49, in Ukrainian, warned of a chemical attack on Kyiv and told people not to go outside. A fourth alert, also at 22:49, stated there was a street fighting threat in Kyiv. At 23:53, a series of all-clear messages were delivered, individually clearing each previous Kyiv alert.

The Radiation Hazard signal was played on loudspeaker devices in the Lviv region due to the app, though there was no actual threat. In Ivano-Frankivsk Oblast, the app reported a false red-level alert between 22:50 and 23:57. Governor Svitlana Onyshchuk said: “Everything is calm in the region for now.” Vinnytsia regional head Natalya Zabolotna warned people not to click on a link in the message, which could be a phishing attempt. Ukraine’s Centre for Countering Disinformation advised the public to turn on smartphone notifications, pay attention to sirens, and read only official sources if the app was not working. A separate air raid alert app specifically for Kyiv was working normally, according to Kyiv authorities.

Russia’s app hit hours later

A few hours after the false alerts in Ukraine, Russia’s Emergencies Ministry said its app was subjected to a “massive cyberattack” that spread false information. The app warns users of incoming drone attacks. Ukrainian news outlet UNN reported the hack sent fake alerts of a nuclear threat inside Russia. Atesh, a partisan Ukrainian group operating inside Russian-held territory, claimed responsibility on Telegram, accompanied by laughing emojis. A screenshot published by Atesh, unverified by the BBC, told users to “urgently” stock up on provisions for three weeks and take cover in basements, using obscene language. Russia’s ministry did not identify a perpetrator, and Atesh’s claim remains unverified.

Ceasefire context

The hacks occurred around the end of a localized ceasefire in the Russian-occupied Kherson region, which began on Tuesday and ended on Sunday. The ceasefire was implemented to allow civilians to evacuate the Russian-occupied city of Oleshky. It was the longest ceasefire of the war so far. Fighting continued elsewhere while the Kherson ceasefire was in place. Russia launched a full-scale invasion of Ukraine in February 2022.

Russia has the world’s biggest nuclear arsenal, and President Vladimir Putin has repeatedly suggested openness to using all weapons at Russia’s disposal. The false alert in Ukraine referenced Russia’s hypersonic Oreshnik missile.