Hackers send fake nuclear and chemical attack alerts to phones in Ukraine and Russia

Hackers sent false warnings of nuclear, chemical and missile attacks to civilians in both Ukraine and Russia on Sunday night, November 1, after the emergency alert apps in both countries were compromised within hours of each other.

Ukraine: a fake Oreshnik alert

In Ukraine, the widely used Air Alert app, built by the companies Ajax Systems and Stfalcon with government support, began pushing false warnings of radiation, chemical threats, a nuclear attack and street fighting in Kyiv.

One alert claimed Russia had launched an Oreshnik, a hypersonic missile that can carry a nuclear warhead, and that a nuclear alert had been declared. Some messages were written in English with spelling and grammar mistakes, others in a mix of Russian and Ukrainian.

Ukraine's air force said the system appeared to have been hacked by Russia. The app's operator temporarily suspended the service, then restored it, and told users not to click links in suspicious notifications.

Russia: hit hours later

Hours later, Russian authorities reported a "massive cyberattack" on their own emergency app. A pro-Ukrainian hacking group called Atesh posted a screenshot of a false alert it said had been sent through the app of Russia's Ministry of Emergency Situations.

Kremlin spokesperson Dmitry Peskov said all of Russia's state agencies faced the constant threat of cyberattacks, including a growing number that use artificial intelligence.

Zelensky: 'we hacked back'

Ukrainian President Volodymyr Zelensky confirmed in an interview with PBS News that Ukraine had hacked Russia's emergency alert system in response to the attack on Ukraine's. He said Ukraine would use such access, if it could, to target missile launch sites inside Russia.

Why it matters

Emergency alert systems save lives in wartime by warning people to take shelter. False alerts can cause panic, and repeated fakes risk teaching people to ignore real warnings.

The hacks came as a six-day local ceasefire around the town of Oleshky, brokered by US First Lady Melania Trump, expired. It is not the first such incident: in March 2023, Russian broadcasters aired a fake nuclear alert that officials blamed on hackers.