Hackers Breach Ukraine and Russia Air Alert Apps, Sending False Nuclear Warnings

Hackers compromised the official air-raid alert applications in both Ukraine and Russia between the evening of 1 November and early 2 November 2026. Users received false warnings of nuclear and chemical threats that authorities later stated did not exist.

In Ukraine, the Air Alert app, developed by Ajax Systems and used nationwide, displayed red-level air-raid warnings across the country shortly before 23:00 local time. Additional messages warned of radiation and chemical danger in areas including Kyiv, along with the threat of street fighting. One message in Russian read: "Hi! There will be a nuclear alert across Ukraine. Don't worry, it's Oreshnik flying." Oreshnik is a Russian intermediate-range ballistic missile that can carry nuclear or conventional warheads. The Ukrainian Air Force posted on Telegram that the app had likely been subjected to hostile interference and that no radiation threat existed. Notifications were temporarily disabled. A separate Kyiv-specific app continued to function normally. Ukraine's Centre for Strategic Communications blamed Russia and noted the use of Russian language in one of the fake messages.

Hours later, Russia's Emergency Situations Ministry reported that its own public alert app had come under a massive cyberattack. Users received notifications claiming nuclear warheads had been launched across all regions of the country. The ministry stated that hackers had sent false information to the public but that the underlying public alert system continued to operate. A Ukrainian partisan group, Atesh, claimed responsibility for the Russian-side alerts according to some reports.

The incidents occurred as a localised six-day ceasefire in the Oleshky area of Kherson region was ending. That truce, reached with mediation involving US First Lady Melania Trump and Pope Leo, had allowed limited civilian evacuations. Ukrainian forces also resumed strikes on Russian oil refineries, including reported damage at the Kstovo facility in Nizhny Novgorod region. Russian authorities said more than 100 drones were destroyed in the area with no casualties confirmed.

Neither government has released technical details of how the apps were breached. The Ukrainian Air Force and Russian ministry both acted quickly to issue public clarifications, limiting the duration of confusion to under an hour in Ukraine. Residents in Kyiv metro stations and other shelters reported checking official channels after the alerts appeared. The episode adds a layer of digital disruption to an already high-intensity conflict that has seen repeated attacks on energy infrastructure and civilian areas.

Cyber operations targeting public warning systems carry immediate practical risks. Citizens who receive nuclear alerts must decide within minutes whether to seek deeper shelter or treat the message as false. Repeated false alarms can reduce compliance with genuine warnings. Both sides have previously accused each other of information operations, but the simultaneous compromise of official apps marks a new level of interference with civil defence tools.

Investigators in both countries will examine server logs, authentication tokens, and any third-party code used by the applications. Ajax Systems has not issued a public statement on the Ukrainian breach. Russian authorities have not named a specific actor. The timing, coming immediately after the Oleshky truce expired and amid ongoing refinery strikes, suggests the hacks were intended to sow confusion at a moment of heightened alertness.

For civilians in both countries, the practical effect was a short period of elevated fear followed by official denial. The longer-term effect is a further erosion of trust in digital warning channels that have become essential for survival in the conflict. Until the technical vulnerabilities are closed, both apps remain potential vectors for similar interference.