Phones across Ukraine buzzed late on Sunday with the kind of message nobody wants to read twice. Air Alert, the government-backed app that tells people when drones or missiles are headed their way, said there was a radiation hazard in Kyiv. Don't go outside.
Then came more. A chemical threat. Street fighting in the capital. A nationwide nuclear alert, followed by a breezy line in Russian telling users not to worry because it was only an Oreshnik in the air.
Within about ten minutes the Ukrainian Air Force said the app appeared to be under enemy influence and that there was no radiation danger. The public alert map had briefly shown Kyiv and other areas under a nuclear alert too.
The Oreshnik is Russia's intermediate-range ballistic missile. It was first used in combat against Dnipro in November 2024 and has since been fired at Lviv and elsewhere. Ukrainians know the name. Whoever wrote that message knew they knew it.
Air Force spokesman Yurii Ihnat said the breach had no effect on military command systems and that the app is not part of them. The developers, Ajax Systems and Stfalcon, working with the Ministry of Digital Transformation, disabled push notifications and then the app itself.
The ministry stressed that air raid sirens and other warning methods were still live. Kyiv residents were pointed to the city's separate app, which kept working normally. Vinnytsia regional governor Nataliia Zabolotna told people not to tap links inside the fake alerts.
By midnight the State Emergency Service said the nationwide system was back to normal. Air Alert itself came back in stages from around 2 a.m. Stepan Tanasiychuk, who leads the project, said new yellow and red alert levels were live on the map and that extra security work was underway. The app had only recently been updated to show drone movements in real time, a detail that now looks like a bigger target than anyone intended.
Panic? Not much, by most accounts. CNN reported that war-weary Ukrainians mostly shrugged, and the memes arrived quickly.
Early on Monday, Russia's Emergencies Ministry said its mobile app had been hit by a massive cyberattack. Attackers, it said, used the app to send false information to the public. Reports say Russian users were told that nuclear warheads mounted on Ukrainian P1-Sun attack drones had been launched at every region of the country.
Ukraine's Center for Strategic Communications had already pointed at Russia for the first hack. Moscow has not publicly claimed the Air Alert breach.
Zelensky was blunt about the second one. Asked by PBS whether Ukraine had hacked the Russian app, he confirmed it was a response to what had been done to Ukraine. "We are only responding to their attacks," he said. He added that Russia has repeatedly gone after Ukrainian banks and the pension system.
None of this happened in a quiet week. The hacks came right after a brief, limited truce around Oleshky ended, a pause that allowed aid and evacuations. Zelensky also said Ukraine has intelligence that Russia is preparing a large new attack on energy and logistics, and that Moscow may be counting on the world looking at the US midterm elections.
Reports also point to US-mediated Russia-Ukraine talks planned in Abu Dhabi next week.
Emergency apps run on trust. People act on them in seconds, often without checking anything else. A hacker who gets into one doesn't need to hurt anyone directly. A few false pushes are enough to scare millions and, maybe worse, teach them to hesitate the next time a real warning arrives. Researchers who study emergency communications have been warning about exactly that for years.
This isn't new ground either. In February and March 2023, Russian radio and TV stations were hacked to broadcast fake air raid and nuclear shelter warnings, and Russia's emergencies ministry blamed hackers then too.
What is new is the speed. One app fell on Sunday night, the other by Monday morning, and one side has now said so out loud.
