Russia and Ukraine have reported cyberattacks on their air raid alert applications after fake emergency warnings, including messages about nuclear attacks, were sent to users on Sunday night.
In Ukraine, the country’s widely used Air Alarm application issued red-level air raid warnings nationwide, while some residents, including those in Kyiv, received additional notifications warning of radiation, chemical attacks and street fighting.
Several hours later, Russian authorities also confirmed that one of their air raid alert applications had been hacked, resulting in the transmission of false warnings, some containing profane language.
It remains unclear who carried out the attacks or whether the incidents were connected.
Following the breach, the Ukrainian air force urged residents to rely on official communication channels for accurate information.
In a statement posted on Telegram, it said, “The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our [Telegram] channel.”
The Ukrainian government subsequently suspended the application temporarily for maintenance, acknowledging that it had “apparently been compromised”.
Some of the fabricated messages were written in Russian, raising suspicions among users that the alerts were not genuine.
A Kyiv resident, Olena, told BBC Radio 4’s Today programme that the notifications initially frightened her. She said, “The first thought was ‘oh my god, I’m not prepared for this’.”
She added, “I’m prepared for blackouts, for a cut in central heating and water supply, but not for nuclear attack.”
Olena said her husband later received notifications warning of street fighting in Kyiv, alongside another message written in Russian.
She said, “After that I understood that somebody had attacked the app, because all notifications we get in Ukrainian.”
In Russia, officials described the incident as “a massive cyberattack”, alleging that false information had been disseminated to the public through the compromised application.
A screenshot shared on Telegram by Atesh, a Ukrainian partisan group operating in Russian-occupied territory, showed a fabricated alert claiming that “nuclear warheads mounted on P1-Suns [a Ukrainian attack drone] had been launched at all regions of Russia”.
The message, which contained profanities, warned residents of a “risk of [things] getting lively” and urged them to “stock up urgently on food for three weeks and hide”.
However, there were no indications on Monday morning that the false messages had triggered widespread panic in Russia.
The incident also received limited attention from Russian media outlets.
Kremlin spokesman Dmitry Peskov, when asked about the breach, did not directly address the incident but said Russian government internet platforms were “one way or another… under constant cyberattacks”, including the presidential website, which he said was targeted “round the clock”.
Peskov also attributed the growing number of cyberattacks partly to the spread of artificial intelligence technology.
Russia’s emergencies ministry said the application would have its “full functionality will be restored by the end of the day”, adding that the incident had not affected the country’s broader emergency alert system.
Although Russia and Ukraine are widely believed to conduct cyber operations against each other, the informal and provocative language in the fabricated messages suggested that hacktivist groups might have been responsible.
Such groups could be aligned with either country but are not necessarily operating under direct government orders.
Cybersecurity experts told the BBC that those behind the attack on Russia’s system may have possessed the necessary capabilities for some time but waited until Ukraine’s alert application was compromised before launching their operation.
Oleksander Merezhko, chairman of the Ukrainian parliament’s foreign affairs committee, said the incident did not cause panic or extreme reactions among citizens.
He told the BBC that Ukrainians, particularly those in Kyiv, were accustomed to “practically non-stop alerts”, adding that “this message was in Russian language which immediately aroused suspicions”.
He further said, “It’s a very unpleasant fact but it is part of cyber war and people in Ukraine understand that. It is possible and we are quite prepared for such possibilities.”
Herbert Lin, a senior research scholar in cyber policy and security at Stanford University, told BBC World Service’s Newsday programme, “I think it’s the first time [a hack of this kind] happened to an official Ukrainian information app, but I suspect it won’t be the last.”
The cyberattacks in Ukraine occurred minutes before the expiration of a localised ceasefire in the country’s frontline Kherson region.
The truce, which began last Tuesday, was partly brokered by US First Lady Melania Trump to facilitate the evacuation of civilians from the Russian-occupied city of Oleshky.
Fighting continued in other parts of Ukraine during the ceasefire, with 15 people killed in an attack on a train platform in Dnipro on Thursday.
Russia launched its full-scale invasion of Ukraine in February 2022.
