Emergency alert applications in both Ukraine and Russia experienced widespread security breaches on Sunday night, resulting in false smartphone notifications warning residents of severe hazards, including potential nuclear attacks, chemical threats, and street fighting.

The simultaneous cyber-incidents unfolded late in the evening, causing brief confusion before authorities quickly worked to calm the public and contain the compromised systems.

False Alerts Disrupt Ukrainian Smartphone Users

Shortly before 23:00 local time on Sunday, Ukraine's widely utilized Air Alert application began broadcasting nation-wide red-level air raid warnings. The app, which is supported by the Ministry of Digital Transformation to notify citizens instantly about defense alerts, also dispatched alarming secondary messages to residents in specific areas, including Kyiv.

The sequence of deceptive notifications included:

  • 22:47: A radiation threat warning declared for Kyiv.
  • 22:48: A Russian-language message warning of a nuclear alert across Ukraine and referencing the "Oreshnik" intermediate-range ballistic missile.
  • 22:49: A chemical attack warning advising residents not to go outside.
  • 22:49: A notification claiming street fighting was taking place in Kyiv.

The security breach also triggered a radiation hazard signal on loudspeaker devices in the Lviv region. However, the Central Intelligence Agency and regional leaders promptly clarified that no actual danger existed. Svitlana Onyshchuk, head of the Ivano-Frankivsk region, and Vinnytsia regional head Natalya Zabolotna both used Telegram to reassure residents that the app had been hacked and warned the public not to click on potential phishing links.

By 23:53, a series of individual all-clear messages had been delivered to connected phones. The Ministry of Digital Transformation temporarily disabled the application for maintenance following the compromise.

Public Reaction and Expert Assessment

Despite the severe nature of the false warnings—particularly the references to nuclear hazards linked to Russian missile capabilities—Ukrainian officials noted that the public did not panic. Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament, observed that Ukrainians are accustomed to frequent alerts and that the use of the Russian language immediately aroused suspicion.

Cybersecurity experts pointed out the significance of the event. Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told the BBC that while it appeared to be the first time an official Ukrainian information app was compromised in this manner, it likely would not be the last. In the event of application failures, Ukraine's Centre for Countering Disinformation advised citizens to rely on official sources, pay attention to physical sirens, and enable smartphone notifications.

Corresponding Hack Reported in Russia

Just hours after the incident in Ukraine, Russian authorities reported a similar breach. The Russian ministry of emergency situations stated that its emergency app had been subjected to a "massive cyberattack" that distributed fake information to the public.

According to the Ukrainian news outlet UNN, the hack was executed by Atesh, a partisan Ukrainian group operating inside Russian-held territory. Purported screenshots shared by the group on Telegram showed alerts warning users that nuclear warheads mounted on attack drones had been launched at all regions of Russia, alongside profane instructions urging residents to stockpile food and hide.

The Russian emergencies ministry emphasized that specialists were working to restore normal operations, noting that the mobile application serves only as an ancillary news service. The ministry stated that the hack did not impact the nation's primary public alert system, which relies on multiple channels including physical sirens, loudspeakers, text messages, and broadcasts on television and radio.

The digital disruptions occurred just as a localized ceasefire in Ukraine's front-line Kherson region officially ended at 23:00 on Sunday, following its implementation the previous Tuesday to allow civilian evacuations from Russian-occupied Oleshky.