The Ukraine and Russia Alert-App Hacks — Fake Nuclear Warnings on Both Sides in One Night

Late on Sunday 1 November 2026, phones across Ukraine lit up with warnings that did not match anything happening outside. Ukraine's official alert app, Air Alert (Povitriana tryvoha), announced a radiation threat, a chemical attack and street fighting in Kyiv, and one message in Russian promised a nuclear alert across the country because an Oreshnik missile was on its way. A few hours later the same thing happened in reverse: the app of Russia's Emergencies Ministry (MChS) told its users that nuclear warheads had been launched at every region of Russia. On Monday 2 November President Volodymyr Zelensky said the second hack was Ukraine's answer to the first.

What Ukrainians Saw

According to dev.ua, the unusual notifications began at about 22:48–22:49 Kyiv time (UTC+2); Reuters put the start just before 11 p.m. The warnings covered the capital and other areas: radiation danger, a chemical threat, and a street-fighting alert telling Kyiv residents not to go outside. The Russian-language message was the giveaway. Reuters noted that Ukrainian is compulsory for all official communications in Ukraine, and the Air Force said on Telegram that the app appeared to have been hacked by Russia. Ukraine's Center for Strategic Communications also blamed Russia, pointing to the language, Al Jazeera reported. According to AAP, the fake alerts mixed Russian and Ukrainian and some were in English with spelling and grammar errors.

All-clear messages followed for each alert. Ukraine's Ministry for Digital Transformation said the app had been temporarily suspended but that other means of alerting the public were working, as were air-raid sirens. The Kyiv Independent reported sirens sounding in several places that night, including Zakarpattia in the west, and regional officials warned that a link in the messages might be a phishing attempt. Yurii Ihnat, the Air Force spokesman, told 1+1 television that the app was separate from military command systems and the breach had no effect on defence operations, AAP reported.

The Operator Interface, Not the Phone App

In an explanation reported by dev.ua on 4 November, the developers apologised and described what had happened. Air Alert is not only a phone app but an ecosystem built on a volunteer basis by Ajax Systems and Stfalcon with the support of the digital ministry: an operator interface, the mobile apps, an alert map and an API. Civil-protection operators and those responsible for warnings in individual communities enter alerts, and the data flows through the API to other systems, including alert maps, loudspeakers in shopping centres and street sirens.

On Sunday evening, the developers said, unauthorised parties gained access to the operator interface, and the system received messages about threats that did not exist, including custom Russian-language messages linking to an outside Telegram channel. The team suspended the operator interface and the app's server side together with the relevant services and ministries, and after checks and removal of the root causes restored the operator interface and the core functions (push alerts and danger levels) within two hours. The display of targets on the map was restored separately. They withheld further details for security reasons, said the installed app does not store or transmit personal data, and denied reports of leaked data or infected phones.

A claim of responsibility surfaced quickly. One fake post referred to a group called Hitcore, and the Russian Telegram channel Mash said Hitcore representatives claimed the breach; AAP said the claim could not be verified independently.

Hours Later in Russia

At around 3 a.m. Moscow time (UTC+3) on Monday 2 November, users of the MChS app received a push notification, according to Kommersant. In crude, colloquial language it said nuclear warheads had been launched at all regions of Russia on P1-SUN carriers, and told people to stock up on food for three weeks and hide in their basements. P1-SUN is the name of a Ukrainian interceptor drone, The Moscow Times noted. The same text then appeared in regional MChS channels on the state-backed messenger Max, from St Petersburg to Belgorod and Sverdlovsk, and on the Telegram channel of the Belgorod region's operational headquarters.

The messages were deleted almost at once, and within about half an hour the ministry said its app had suffered a massive cyberattack that let the attackers send fake information to the public. Later in the day it said 33 regions had received the false message. It said the incident was spotted the moment the first false messages arrived, that the services were disconnected from the network and isolated, and that its specialists had identified the vulnerability the attacker used and passed the data to the National Coordination Center for Computer Incidents, Expert reported. The ministry described the app as a supplementary service and said the main warning channels, regional and municipal sirens and loudspeakers, SMS, television and radio, had not been and could not be affected.

The Kremlin spokesman Dmitry Peskov said the websites of the president and of other agencies come under cyberattack many times a day and that the threat grows as technologies, including artificial intelligence, develop, Kommersant reported. A group calling itself DC8044, which describes itself as a Kyiv-based hacking community, claimed the Russian attack and said it got in through the app's API, according to The Record. The pro-Ukrainian group Atesh posted a screenshot of the Russian alert early on Monday, Reuters reported.

"We Only Respond"

Asked by PBS NewsHour on Monday 2 November whether Ukraine had answered by hacking Russia's emergency app, Zelensky confirmed it, according to the Kyiv Post and AAP. He described the attack on Air Alert as one of a long series of Russian cyberattacks, including on banking and pension systems, and said Ukraine was only responding to Russian attacks.

Who carried out the first hack has not been established by anyone outside the two governments. Reuters said it could not verify which groups were responsible, and noted that earlier incidents in the war had been linked both to activist hackers and to intelligence agencies on each side.

Why It Matters

Al Jazeera wrote that this appeared to be the first time either Ukraine's or Russia's official alert apps had been hacked. It was not the first fake warning in the region, nor the first hacked alert app anywhere: The Record recalls that in 2023 several Russian commercial radio stations were interrupted with fake air-raid warnings, and that Group-IB reported the hacktivist group AnonGhost had compromised Israel's Red Alert rocket-warning app the same year.

What was new was the mirror image. Within one night each country's civilian warning app, the channel people are trained to trust in an emergency, was turned into a source of panic, and the Ukrainian president openly called the second attack retaliation. Both sides then made the same argument in defence: that the app is only one channel, and that sirens, broadcasts and official accounts remain the authority. For Ukraine, where the app's data also feeds maps, loudspeakers and sirens through its API, the weak point was not the phones but the operator's console. Like the French supermarket refrigeration attack, it was an attack on a system's trusted control point rather than on its data.