Ukraine and Russia Both Report Hacks of Air-Raid Alert Apps as Kherson Truce Ends

Two countries at war had their public air-raid warning apps hijacked within hours of each other. The apps are among the few tools civilians rely on to know when to run for shelter.

What hit Ukraine

The fake alerts began late Sunday night, Nov. 1. The BBC's live reporting put the first false red-level alerts at about 22:47 local time.

The Air Alarm app told users in Kyiv there was a radiation threat and a chemical attack. It also warned of "street fights" and incoming Oreshnik missiles. The Oreshnik is Russia's intermediate-range ballistic missile, which Russia says can carry nuclear warheads.

One message was written in Russian: "There will be a nuclear alert across Ukraine. Don't worry, it's Oreshnik flying." Loudspeakers in Kyiv also blared precautionary messages, and the public alert map showed Kyiv and other areas under a nuclear alert.

The Ukrainian Air Force responded on Telegram within the hour. "The air alert app appears to have been subjected to enemy influence. There is no radiation threat! Stay calm," it said. Air Force spokesman Yuriy Ignat confirmed to AFP that the app had been hacked.

The app has 6.7 million users, according to Ukraine's digital transformation ministry and its developer, Ajax Systems. The ministry later said the nationwide alert system itself was operating normally and that threat signals were still reaching regional administrations and street sirens.

What hit Russia

Early Monday, Russia's Emergencies Ministry said on Telegram that its mobile app "has been subjected to a massive cyberattack, enabling attackers to send false information to the public." Russian authorities took the app offline, according to the Guardian's live coverage.

Regional alert channels run by the ministry sent vulgar, nonsensical messages in Russian, according to screenshots seen by Business Insider. One said "P1-Sun carriers," a reference to a small Ukrainian interceptor drone, were sending nuclear warheads to Russia. Another told Russians to stockpile three weeks of food.

Moscow has not said who it thinks is responsible. The Guardian reported that a Ukrainian hacker group claimed to have sent the fake nuclear warnings to Russian users. The Times of India reported that a Ukrainian group was reportedly suspected. Neither claim has been confirmed by an official.

Who did it

Ukraine's Center for Strategic Communications, SPRAVDI, said Russia hacked Air Alarm. Ukrainian MP Oleksandr Merezhko, who chairs the parliament's foreign affairs committee, pointed to the Russian-language message as the reason Kyiv believes Moscow was behind it.

On the Russian side, Merezhko would not go further. "In such cases we don't confirm or don't deny," he said, adding there is "no official confirmation, as of yet at least" that Ukraine hit Russia's app.

A Ukrainian hacktivist contact told the BBC's cyber correspondent Joe Tidy that the Russian hack was "most likely" retaliation. The contact said attacking alert systems had "not been used due to moral and ethical considerations." Social media posts show Ukraine's app was hit first, but the BBC said it is not clear which system was breached first.

No group has claimed the Ukrainian hack. Neither government has presented technical evidence of who was behind either attack.

Similar tactics have been used before. In February 2023, Russian radio stations broadcast fake air-raid and missile alerts, according to Business Insider. The Guardian described the weekend's incidents as the first breach of this scale against an alert app in the war.

The truce that just ended

The hacks came as the war's longest truce expired. The pause was limited to Ukraine's Kherson region and began early Tuesday, Oct. 27. It was brokered by First Lady Melania Trump and allowed a humanitarian mission into Russian-occupied Oleshky.

Ukrainian human rights commissioner Dmytro Lubinets said the ceasefire, in effect from Oct. 27 to Nov. 1, "has ended." Kyiv says Russia refused an extension. Kherson governor Oleksandr Prokudin told residents to "respond immediately to warnings about Russian attacks."

The fighting did not slow. Both sides struck energy targets overnight, including oil refineries, with strikes reported in Zaporizhzhia and Odesa. A Russian strike on Nov. 1 partially destroyed the city administration building in Kramatorsk.

The fake alerts in Kyiv did not coincide with any reported strike. The danger is what repeated false alarms do to trust. Merezhko said Ukrainians have become used to constant alerts and "tend to treat all kind of information with a certain scepticism." A real warning could be ignored, or a fake one could send people outdoors or into the wrong shelter.

Estonian Foreign Minister Margus Tsahkna has been arguing that Russia is leaning on hybrid tools such as cyberattacks and GPS interference. He told Reuters in October that Western European societies are not mentally ready for that kind of pressure.

The diplomatic calendar is also tight. US-mediated Russia-Ukraine talks, effectively frozen since the US and Israel struck Iran in February, are set to resume this month. President Volodymyr Zelensky said Sunday that Ukraine would stop hitting Russian oil refineries, as President Donald Trump has demanded, if Washington supplies Patriot interceptors.

Whether either government will name a culprit, and whether the apps' operators can show how attackers got in, are still unanswered.