Cyberattacks disrupt emergency alert apps, fake nuclear warnings

False messages about radiation, chemical threats and incoming nuclear missiles spread through civilian warning applications as both countries reported breaches. The incidents came hours after a six-day humanitarian ceasefire in Ukraine’s Kherson region ended.

Authorities in Ukraine and Russia have reported cyberattacks on their emergency alert applications after users received fabricated warnings of nuclear danger, radiation exposure and other threats, raising concerns about the vulnerability of civilian communication systems during wartime.

In Ukraine, a series of unusual notifications appeared on the national Air Alert application late on Sunday, 1 November. The messages warned residents against going outside because of alleged radiation hazards, chemical threats and street fighting. One notification, written in Russian, claimed that a nuclear alert had been declared across the country and referred to Russia’s nuclear-capable Oreshnik missile.

Ukraine’s Air Force said the application had probably been compromised and confirmed that there was no radiation threat. It urged residents to remain calm and follow official information channels. The app’s developers subsequently acknowledged unauthorised interference, temporarily suspended the service and began restoring its operation after identifying the incident as a cyberattack.

The breach affected a communication tool widely used by Ukrainians to receive warnings about incoming Russian missiles and drones. However, the State Emergency Service said the country’s wider national warning system was operating normally. Ukrainian officials also indicated that the incident had not affected military command or defence operations.

Hours after the Ukrainian incident, Russia’s Emergencies Ministry said its own mobile application had suffered what it described as a massive cyberattack. The ministry reported that hackers had distributed false information to users, including warnings about alleged nuclear warheads launched towards Russian territory.

The ministry said the public alert system remained operational and that the mobile application was an additional information service. It later reported that the service had been restored, although the initial statement indicated that technical work was required following the intrusion.

Neither government has established publicly who was responsible for the respective incidents. A Russian Telegram channel, Mash, reported that a group called Hitcore had claimed responsibility for the Ukrainian breach, but the claim could not be independently verified. Russian authorities did not identify a perpetrator for the attack on their own application.

It also remains unclear whether the two incidents were connected or represented separate operations. The timing and similarities in the false messages have drawn attention to the potential use of digital platforms to spread confusion during an armed conflict, but they do not establish common responsibility.

The incidents highlight the risks associated with digital infrastructure that civilians rely on during emergencies. In Ukraine, mobile notifications can provide warnings of missile and drone attacks, allowing people to seek shelter. False information distributed through the same channel can undermine confidence in genuine alerts and complicate decisions during a crisis.

The fabricated messages were particularly sensitive because they referred to nuclear and chemical threats. Such warnings can generate fear and confusion even when they are quickly disproved. Ukrainian media reported that some public warning sirens and loudspeaker systems in the western Lviv region also broadcast a radiation hazard signal.

The response from Ukrainian authorities underscored the importance of maintaining alternative communication channels. Officials advised residents to rely on verified government and military updates, functioning public warning systems and official social media accounts rather than suspicious notifications.

The episode also demonstrates the distinction between compromising an individual application and disabling a country’s entire emergency infrastructure. Both governments said their wider warning arrangements continued to function, although the attacks disrupted or affected the mobile services used by members of the public.

The reported attacks came as a six-day humanitarian ceasefire in the Russian-occupied town of Oleshky in Ukraine’s southern Kherson region came to an end on Sunday. The arrangement, which ran from 27 October to 1 November, was intended to facilitate aid deliveries and the evacuation of civilians from an area facing severe humanitarian difficulties.

The ceasefire was brokered with the involvement of US First Lady Melania Trump and Pope Leo XIV. Trump said nearly 800 people had been evacuated, while officials on both sides acknowledged that some residents chose to remain in the town.

Before the truce, the United Nations had estimated that around 2,000 civilians remained in Oleshky, with hunger and heavily mined roads making departure difficult. Ukraine’s human rights ombudsman, Dmytro Lubinets, said further humanitarian initiatives were being explored with his Russian counterpart.

The ceasefire was limited to a designated area and humanitarian objectives; it did not represent a broader agreement to end the war. After it expired, Ukraine’s armed forces accused Russian troops of using the pause to rotate units and strengthen positions. Kremlin spokesman Dmitry Peskov said both sides could use ceasefires to regroup, describing such activity as common practice.

The developments illustrate the fragile nature of limited humanitarian arrangements amid continuing military hostilities. While the evacuation operation provided an opportunity for civilians to leave an endangered area, the allegations over military activity during the truce underline the difficulties of separating humanitarian cooperation from the wider conflict.

The simultaneous reports of compromised emergency applications in two opposing countries add another dimension to the conflict’s digital front. Civilian alert systems are designed to provide timely, trusted information, making their credibility an important part of public safety.

The immediate priority for both governments is to secure the affected applications, investigate how unauthorised parties gained access and ensure that residents can distinguish genuine emergency instructions from fabricated messages. The incidents also raise questions about the need for redundant alert channels and stronger safeguards for digital services that operate during military emergencies.

There is, so far, no verified evidence that the two cyberattacks were coordinated. Nor did the false notifications indicate an actual nuclear or chemical threat. But the disruption demonstrates how the manipulation of civilian communication infrastructure can create public alarm without a conventional military strike.

As the war continues, protecting emergency information systems will remain an important part of civilian resilience. Their reliability depends not only on technical security but also on public confidence that warnings issued through official channels can be trusted.

Sources: NBC News — Fake alerts warn of nuclear danger as Ukraine and Russia report emergency app hacks; Associated Press — Ukraine and Russia report fake emergency alerts after cyberattack targets apps; Al Jazeera — Ukraine blames Russia after air alert app sends out false warnings; The Guardian — Ukraine and Russia say emergency air-raid warning systems hit by cyber-hacks; Meduza — Emergency alert apps hacked in Russia and Ukraine, sending false warnings of nuclear threats; Interfax-Ukraine — Humanitarian ceasefire in Oleshky ends after aid delivery and civilian evacuation.