Ukrainian users receive fake warnings of nuclear and chemical threats, while Moscow reports ‘false information’ on its emergency app as fighting resumes.
Russia and Ukraine have both reported cyberattacks on their public emergency alert applications within hours of each other, with hackers sending false warnings of nuclear, chemical and other threats to users’ phones. The incidents came as a rare localised ceasefire in southern Ukraine expired.
Late on Sunday evening, Ukraine’s Air Force said its widely used Air Alert app had been subjected to “enemy influence.” Users in Kyiv and other regions received a rapid sequence of fabricated notifications. One warned of a radiation threat in the capital and instructed people not to go outside. Another, in Russian, claimed a nuclear alert was in effect across Ukraine and referenced Russia’s Oreshnik hypersonic missile. Further messages spoke of chemical threats and street fighting.
“The air alert app appears to have been subjected to enemy influence,” the Ukrainian Air Force posted on Telegram. “There is no radiation threat! Stay calm and follow our updates on our channel.” Officials stressed that air-raid sirens and other notification channels continued to function normally. Ukraine’s Ministry for Digital Transformation temporarily took the compromised app offline while a separate capital-specific app remained operational.
Cyberattacks Trigger False Emergency Alerts in Ukraine and Russia:
Ukraine’s Centre for Strategic Communications (SPRAVDI) blamed Russia for the breach. Screenshots shared online showed the false alerts appearing on phones alongside the app’s familiar interface. The Air Alert app, developed with support from Ukraine’s digital ministry and security firm Ajax Systems, is used by millions of people across the country to receive real-time warnings of incoming Russian missile and drone attacks.
Hours later, early on Monday, Russia’s Emergencies Ministry announced that its own mobile application had come under a “massive cyberattack.” The ministry said the intrusion allowed attackers to send “false information” to the public. One reported message claimed nuclear warheads mounted on Ukrainian attack drones had been launched at regions across Russia. Moscow stated that its broader public alert system was operating normally and that efforts were under way to restore the app. It did not attribute the attack to any specific actor.
It remains unclear whether the two incidents are connected. Both sides have long accused each other of conducting cyber operations as part of the wider conflict that began with Russia’s full-scale invasion of Ukraine in February 2022. Cyberattacks on critical infrastructure, government systems and information channels have been a persistent feature of the war.
The timing of the false alerts coincided with the end of a multi-day humanitarian truce in the Kherson region. The localised ceasefire, which had allowed limited civilian movement and aid deliveries, expired after Russia declined an extension proposed by Kyiv. Fighting and drone activity quickly resumed in the area.
Public emergency apps have become essential tools for civilians living under the constant threat of aerial bombardment. In Ukraine, the Air Alert system provides location-specific warnings that often give residents only minutes to reach shelters. False alarms of nuclear or chemical attack risk creating panic, eroding public trust in official channels, and potentially desensitising people to genuine threats.
Ukraine and Russia Hit by Cyberattacks:
Both governments moved quickly to reassure the public. Ukrainian authorities directed citizens to official Telegram channels and alternative apps for verified information. Russian officials similarly emphasised that core emergency systems remained intact. Cybersecurity specialists note that compromised notification systems can be used not only to spread fear but also to test defences or distract from other military activity.
The reciprocal nature of the reported breaches underscores the digital dimension of the conflict. As conventional fighting continues along the front lines, both sides continue to probe and disrupt each other’s information and warning infrastructure. Independent verification of the exact technical methods used in the attacks has not yet been published, and neither government has released detailed forensic findings.
For ordinary citizens on both sides of the border, the incidents serve as a reminder of the vulnerability of even the most critical civilian systems in a prolonged war. As authorities work to harden their alert platforms, the public has been urged to treat unexpected or unusually alarming notifications with caution and to cross-check information through multiple official sources.