Hackers hijack Ukraine's Air Alert app to send fake nuclear alerts

Ukraine's Air Alert app, which tells people when to take shelter, sent false warnings of radiation and chemical threats and of street fighting in Kyiv on Sunday evening, November 1. The messages began at about 22:45 Kyiv time, Suspilne reported. Some arrived in Russian, and one referred to a strike by an Oreshnik missile.

Shortly after 23:00 the Ukrainian Air Force said the app had "probably been subjected to enemy influence" and that "there is no radiation threat." The Ministry of Digital Transformation repeated the warning, and the app was taken offline. The government's Center for Strategic Communications said Russians had hacked the app, pointing to the unusual mix of threats and the Russian-language caption about Oreshnik. No group has claimed the attack, and no official has said how the app was compromised.

A private app, not the siren network

Air Alert is not the state warning system. It was launched in 2022 with support from the Ministry of Digital Transformation and built by the Ukrainian companies Ajax Systems and Stfalcon; Suspilne reports Ajax wrote the first version in a single day. It relays air raid alerts to phones as push notifications. The State Emergency Service said the national warning system was working normally and that alerts were still reaching regional administrations and street sirens. Kyiv's city administration said its own Kyiv Digital app and the capital's sirens were unaffected.

The Center for Countering Disinformation told people not to follow any third-party links and not to share unverified information, which suggests some of the false notifications carried links. The ministry advised users to switch on the emergency alerts built into iOS and Android, the state's cell broadcast system, which reaches phones even in silent mode, until the app is back.

Whoever sent the messages was able to push notifications to the app's users through a channel the government does not run itself. Whether that came from stolen credentials, a compromised server or a third-party notification service has not been disclosed.