The Air Alert App Hacked on Sunday Sent Its Own Radiation Warnings to Kyiv
The warnings were the app's own threat types, switched on by someone else. By morning the app was back, with the live-target map still off.
At 22:47 on Sunday, phones in Kyiv lit up with a radiation danger card for the city. A minute later a second message arrived in Russian, telling users not to worry because a nuclear alert was coming across Ukraine and the Oreshnik missile was on its way. At 22:49 came two more: a chemical threat in Kyiv, with instructions not to go outside, and street fighting in the capital. The warnings were the app’s own threat types, already built in and waiting to be switched on.
The all-clear messages reached phones at 23:53, one for each fake threat. Ukraine’s Air Force had already posted on Telegram that the app appeared to have come under hostile influence, that there was no radiation threat, and that people should stay calm and follow its own channel. The app’s operators disabled push notifications and suspended the service overnight. The sirens in the streets never sounded for the fake alerts, and Kyiv’s own city app kept working normally through the night.
Vitaliy Zalevskiy, posting on Threads with a screenshot of the 22:47 card, asked his followers what they had done first when they saw it, adding in parentheses that the app had been hacked and there was no need to panic. His screenshot showed 22:47. One woman wrote, in a translation from Ukrainian, that she had laughed at the hackers and their mangled greeting. Another wrote that she had run to put a chicken in the oven because the electricity had just come back on. The thread kept a record of the first minutes as people described them: coats grabbed, hallways, screenshots taken before anything else, and then the jokes, once the Russian wording gave the messages away.
The Russian wording was the first thing the thread noticed. Officials pointed to it too. Ukraine’s Centre for Strategic Communications said the Russian language in one of the messages was evidence of who was behind it, and told anyone seeing strange messages in the app not to panic. Oleksander Merezhko, who chairs the foreign affairs committee in Ukraine’s parliament, told the BBC that Ukrainians, Kyiv residents in particular, were used to practically non-stop alerts, and that the message in Russian aroused suspicion at once. Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told the BBC World Service it was the first time the hack had happened to an official Ukrainian information app. He suspected it would not be the last.
The Air Alert app hacked on Sunday had been built for exactly this kind of night, in a hurry. Stfalcon and Ajax Systems built Air Alert with Ukraine’s Ministry of Digital Transformation in one day in March 2022, after people in districts where the street sirens could not be heard needed another way to be warned. More than two million people downloaded it in its first week. Ajax Systems says it has since been downloaded 46 million times and is used daily by more than 6.7 million people, for six types of threat. The design choices from that first day were still in it on Sunday. The alarms sound at the loudest possible volume even when a phone is in silent or sleep mode. Regional administrations feed alerts straight to a console that pushes them out. The app asks for no registration and collects no personal data and no location. Stfalcon’s own instructions told users to listen to the street sirens as well as the phone.
The app’s team said the service stored no personal data, so users faced no threat from the intrusion. It warned them not to open links in suspicious notifications. The warning mattered because the fake Russian-language message carried one: a link to a Telegram channel, visible in screenshots of the alerts that Ukraine’s strategic communications centre published. Natalya Zabolotna, the head of the Vinnytsia region, confirmed the cyberattack and warned people not to click the link in the message, which could be phishing. A Russian Telegram channel, Mash, said representatives of a hacking group calling itself Hitcore had claimed responsibility and had tricked an employee into opening his computer to them. That claim could not be independently verified, and no Ukrainian authority had named an attacker by Sunday night beyond blaming Russia in general terms.
Svitlana Onyshchuk, the head of the Ivano-Frankivsk region, said everything was calm there even though the app had shown a red-level alert for her region from 22:50 to 23:57. In the Lviv region the false alerts set off a radiation hazard signal on public loudspeakers, with no real threat behind it. On Sunday the sirens stayed silent and the phone shouted.
A few hours later, in the early hours of Monday, the same kind of message arrived on the other side. Users of Russia’s Emergencies Ministry app received warnings claiming nuclear warheads mounted on Ukrainian P1-Sun drones had been launched against every region of Russia, telling them to stock up on three weeks of food and hide in their cellars. The message as seen by Reuters was laced with profanities and called Russia’s regions swamps, and it did not try to sound like an official communication. Atesh, a pro-Ukrainian partisan group, claimed the hack on its Telegram channel, and that claim has not been independently verified. Russia’s ministry called the incident a massive cyberattack, said its experts were restoring the app, and asked the public to trust only its website and official social media accounts. It also played down the app itself, calling it a supplementary source of information beside sirens, text messages, television and radio.
On Threads, a user in Russia who posts as nessdoris put up a screenshot of the 02:45 alert from the Moscow region. The caption, in a translation from Russian, said it looked as if the Emergencies Ministry app had been hacked. The replies under a second screenshot from Kursk read the night as an exchange. One wrote, in translation, “We to them / They to us,” and another wrote that Ukrainians had received threats too, only in their own language, and that some joker was messing around. Both threads spotted the same thing first: the messages did not sound like their own governments.
By before 02:00 on Monday the Ukrainian developers said they were gradually bringing Air Alert back. The map again showed yellow and red danger levels for drone and missile attacks, and push alerts were working. The display of targets on the map stayed suspended, the one part of the app that showed users what was flying and where. It was the feature added most recently, a map of drone and missile movement that appeared in the app on 17 October. Kyiv’s street-warning system had misfired six days earlier, when a technical malfunction sent repeated alerts that the city administration later explained and apologised for.
Russia’s statistics agency, Rosstat, confirmed its systems had been attacked between 29 October and 1 November. It said no database or protected information had been exposed. Two hacking groups claimed to have taken between 10 and 23 terabytes of data, including material on military losses. Those claims rest on the groups’ own posts and could not be independently verified. The fake alerts also arrived minutes before a six-day local ceasefire expired at 21:00 GMT on Sunday. The pause around the Russian-held town of Oleshky was the longest local pause since the invasion began in 2022. Ukraine’s General Staff said afterwards that Russian forces had used it to rotate units and fortify positions. Russia has fired the Oreshnik at Ukraine three times, most recently near Bila Tserkva in May, and a Russian lawmaker threatened a fourth launch in September. In February and March 2023, hackers cut into Russian radio and television broadcasts with false air-raid and nuclear-shelter warnings, and the tools have changed since then, from broadcasts to the apps in people’s pockets.
Air Alert’s alarms also reach beyond phones. Ajax Systems says the alerts are transmitted directly to its security systems. Air raid warnings can sound through physical Ajax sirens wherever the system is installed, and doors at more than 400 shelters open automatically when an alert arrives.
