Cyberattacks hit Ukraine and Russia alert apps, sending false nuclear warnings

False nuclear alarms in Ukraine

Ukraine's Air Alert app, which warns citizens of Russian air raids, was hit by a cyberattack on the evening of Sunday, 1 November. Around 22:47 local time, the app began sending red-level air raid warnings, followed by messages claiming raised radiation in Kyiv, a risk of chemical attack and armed clashes on the streets of the capital and other areas. One alert referred to the Oreshnik missile and claimed a nuclear alarm had been triggered across all of Ukraine. Alert-end messages followed a little over an hour later.

The Ukrainian Air Force said the app had probably been hit by hostile interference and moved quickly to rule out any radiation threat on Telegram.

“There is no radiation threat! Stay calm and follow the updates on our channel.”

The Air Alert team said unauthorised people had entered the app. It switched off push notifications, suspended the service temporarily and told users it stored no personal data.

“The app does not store personal data, so there is no threat to users.”

Russia's emergency app hit

Hours later, Russia's Ministry of Emergency Situations said its mobile app had suffered a mass cyberattack. TASS reported in the early hours of Monday, 2 November, citing the ministry, that hackers had spread false information to the public. One fake message said nuclear warheads had been launched at all regions of Russia and told residents to stock food for three weeks and shelter in basements. Russian regional media said the official app and the department's regional channels on the MAX messenger had also been breached.

The ministry said it was working to restore the app and described it as a supplementary information service. It said the wider public warning system worked normally through sirens, loudspeakers, mobile messages and broadcasts. It did not name anyone responsible for the attack.

Who may be behind the attacks

Spravdi, Ukraine's Center for Strategic Communications, blamed Moscow for the attack on the Air Alert app. It pointed to a Russian-language message and a reference to the Oreshnik, and posted a screenshot on X showing alerts that mentioned nuclear and chemical weapons. Its attribution has not been confirmed independently, and Russia did not comment on who might be responsible.

Wes Streeting, the British defence minister, said in Brussels that he did not yet know who was behind the attack on Ukraine's warning system, but that his government would watch the case closely. He met EU High Representative Kaja Kallas there and pointed to hybrid and state-funded terror attacks across Europe that he said were orchestrated from Moscow. Kallas said Russia was trying to harm civilians as much as possible so the warnings would fail and as many people as possible would die. She also said July, August and September were the deadliest months for Ukrainians since the war began.

The Kherson truce

The cyberattacks came as a six-day local truce around Oleshky, a city in Kherson region under Russian occupation since 2022, expired at midnight Moscow time, or 23:00 Greek time. The truce was reached through mediation by Melania Trump, the US first lady, with the participation of Pope Leo XIV, and it allowed civilians to be moved out. Ukraine's army said it evacuated 167 people from southern Kherson region on Sunday, shortly before the truce ended. Reports describe it as the longest local pause in fighting since the Russian invasion began in 2022. Neither side showed signs of immediately resuming hostilities, but Ukrainian authorities told residents to stay alert to possible new Russian attacks.

What remains unclear

The two incidents, which came within hours of each other, have not been confirmed as linked. It is also unknown who carried them out and whether the same actors were behind both. Ukraine's Digital Transformation Ministry said the Air Alert app was offline while sirens and other alert channels kept working.