Cyberattacks on both Russia’s and Ukraine’s emergency alert apps resulted in fake messages about missile and nuclear strikes broadcast to the public. Officials from both countries confirmed the attacks, which occurred at similar times, on Sunday evening. According to public statements and messages sent via social media, Ukraine’s alert app was hit first, with the country’s Air Force quick to dispel nuclear fears. “The Air Alert app has likely been compromised,” it said via Telegram at around 2100 UTC. “There is no radiation threat! Stay calm, follow our messages on our channel!” At around 0030 UTC on Monday, Russia’s Ministry of Emergency Situations confirmed the country’s app had also been abused, with fake messages sent to citizens’ devices. “Attention! The Russian Ministry of Emergency Situations’ mobile app has been subjected to a massive cyberattack, allowing attackers to send fake information to the public,” it said, also via Telegram. “Work is currently underway to patch the vulnerability and restore normal operation.” The ministry issued an update around 90 minutes later, saying the app was once again functioning normally, and pointing out that an attack on the app was not the same as a compromise of the state’s national alert system. “Citizens are alerted through primary channels: regional and municipal alert systems (sirens, loudspeakers), communication networks (SMS messaging), and television and radio broadcasts. The mobile app is merely an additional, supporting information service,” it stated. Ukraine’s Ministry of Digital Affairs also issued a public announcement reminding citizens about how to receive emergency warnings while its “Alarm!” app was down. These include enabling iOS and Android emergency alerts, state-controlled sirens, and other official sources, such as the official social media accounts of Ukraine’s government. According to the messages sent to devices after the compromise of Ukraine’s alert app, the fake warnings pertained to various threats, such as street fights in Kyiv, chemical attacks, and radiation hazards. Alerts about the threat of nuclear fallout from official government warning systems would normally lead to panic, however, one of the earliest messages sent to citizens was written in Russian and referenced the “Oreshnik” missile, which was an immediate signal that the message may not be genuine. Equivalent alerts sent to Russian citizens also warned of impending nuclear strikes “at all regions of Russia,” referencing “P1-Sun,” the name of a Ukrainian attack drone. Oleksander Merezhko, who chairs the Ukrainian parliament’s foreign affairs committee and noted the suspicious Russian-language alert, told the BBC the attack was almost certainly part of Russia’s cyber war. “It’s a very unpleasant fact but it is part of cyber war and people in Ukraine understand that,” he said. “It is possible and we are quite prepared for such possibilities.” Russia has not explicitly blamed Ukraine for the attack on its app, and official sources say the app is running as normal. Ukraine’s announcement of the alert app cyberattack came almost simultaneously with the official conclusion of a six-day ceasefire in Kherson. Russia agreed to the rare temporary suspension of conflict to allow hundreds of Ukrainians to evacuate the Russian-occupied city of Olehsky. Russia did not agree to a proposed extension of the ceasefire, which officially ended at around 2100 UTC – around the same time Ukrainians began receiving fake warning messages. ®
Source: The Register — Security · 2026-11-02