Emergency alert apps in both Ukraine and Russia were targeted by cyberattacks on Sunday, sending false warnings of nuclear, chemical and other threats to millions of users, authorities in both countries confirmed.
In Ukraine, the Air Alert app issued a series of fake notifications late on Sunday, shortly before 11pm local time. Users received warnings of an imminent nuclear radiation threat, a chemical attack, street fighting in Kyiv, and a possible strike by Russia's Oreshnik hypersonic missile, which can carry nuclear warheads.
The messages were written in English — with spelling mistakes — as well as in Ukrainian and Russian. One message in Russian claimed Ukraine was about to be hit by Oreshnik missiles. The Kremlin has used the ballistic weapon three times previously, striking the Kyiv region and the cities of Dnipro and Lviv.
Ukraine's Air Force responded on Telegram, stating: "The air alert app appears to have been subjected to enemy influence. There is no radiation threat! Stay calm and follow our updates on our channel."
The Ukrainian emergency app also said "unauthorised parties" had interfered with its operation and that the channel had been temporarily suspended. Users were warned not to click on links in "suspicious notifications."
Ukraine's Center for Strategic Communications blamed Russia, pointing to the use of the Russian language in one of the fake messages.
Reactions among the public were mixed. Many residents ignored the alerts, assuming the app had been compromised. Others were frightened. "I was briefly terrified," said one woman, Nina. "I lay on my bed and wondered what was coming."
Loudspeakers in central Kyiv also broadcast the false warnings. According to reports from the scene, most people understood within about half an hour that the alerts were the result of a hacking attack.
Hours later, on Monday morning, Russia's Ministry of Civil Defence, Emergencies and Disaster Relief announced that its own warnings app had come under a "massive cyberattack." The ministry said the app wrongly warned users of imminent drone attacks, with fake alerts claiming that "nuclear warheads mounted on P1-Suns had been launched on all regions" of the country. Users were also instructed to stock up on food for three weeks and to seek shelter immediately.
The Russian ministry did not name any suspects but said the alerts had spread "false information" and that efforts were ongoing to restore the app's functionality.
A Russian Telegram channel with links to the security services reported that it had spoken to representatives of a hacking group called Hitcore, which allegedly claimed responsibility for the attacks. The report could not be independently verified.
It remains unclear who carried out the cyberattacks, whether the two incidents are connected, and what the motive may have been.
This appears to be the first time either country's official emergency alert apps have been hacked. Cyberwarfare has nonetheless been a significant feature of the conflict since before Russia's full-scale invasion in February 2022. In late 2023, the Russian hacker group Sandworm took Ukraine's private telecommunications network Kyivstar offline, disrupting notifications for several days. Ukrainian groups, including the volunteer-based IT Army of Ukraine, have also conducted multiple cyberattacks against Russian targets, reportedly including the Moscow Stock Exchange, Russian power grids and several government websites.
The fake alerts coincided with the end of a six-day localised ceasefire in the Russian-occupied Kherson region, which the United States said was brokered by first lady Melania Trump. The truce, described as the most significant pause in fighting since 2022, allowed for humanitarian aid deliveries and civilian evacuations from the nearby town of Oleshky. The ceasefire expired at 11pm on Sunday.
Hours after the truce ended, Russia resumed attacks on the southern city of Kherson. Kherson's military administration said a Russian drone struck a hospital at 7:40am. Video footage showed wrecked rooms, blown-out windows, broken doors and debris in the street. Officials said no one was hurt.
There is evidence that Russian forces used the six-day ceasefire to strengthen their positions in Oleshky and rotate in new troops. Footage shared with media showed Russian soldiers deploying heavy military equipment, delivering ammunition and moving armoured vehicles through the city's streets. According to the commander of Ukraine's 34th Separate Marine Brigade, Dmitry Pulinets, Russian soldiers had previously been unable to move freely in the city at any hour or in any weather conditions. "Now they have this opportunity. And for the last few days this movement has been happening constantly," he said.
Melania Trump said in a post that more than 750 people had left Oleshky during the evacuation. Ukraine's ombudsman, Dmytro Lubinets, who visited the town to coordinate the mission, said the model could be repeated in other occupied cities in the Kherson region. He declined to reveal how many residents had chosen to go to Ukraine and how many to Russia, citing an agreement with Moscow to keep the figures confidential.
Vladimir Putin's spokesperson, Dmitry Peskov, said on Monday that there were no immediate plans for another truce elsewhere, adding that it was standard practice for army units to regroup in such circumstances.
