Ukraine and Russia’s emergency alert apps both hacked, residents warned of fake nuclear, chemical strikes

Kyiv — Ukrainian and Russian emergency alert apps used to warn civilians of incoming missiles, drones and other military attacks were hacked hours apart on Sunday night, sending out false messages about radiation, chemical attacks and nuclear strikes.

At 10:47 p.m. local time (3 p.m. Eastern), Air Alert, a Ukrainian app developed by Ajax Systems and Stfalcon with support from Ukraine’s Ministry of Digital Transformation, started sending out false warnings of radiation, chemical threats, a nuclear attack and even street fighting in Kyiv. 

Some Ukrainians rely on the app to decide whether or not to take shelter ahead of incoming Russian missile and drone strikes. Many also rely on the social media platform Telegram, however, where the country’s Air Force and security analysts share more specific information about incoming strikes.

The Ukrainian Air Force confirmed just 10 minutes later, at 11:02 p.m. local time, on multiple platforms, that the notifications were false. “The Air Alert app appears to have been subjected to hostile interference. There is no radiation threat!” the Air Force said in a message shared on Telegram, urging Ukrainians to remain calm and follow official updates.

Some Kyiv residents told CBS News they immediately knew the notifications were fake after checking Telegram channels.

A couple of hours later, at 2:45 a.m. in Moscow (6:45 p.m. Eastern), Russia’s Emergencies Ministry app was also hacked. False alerts were sent to users in 33 regions, according to Russia’s tightly controlled media, which said the messages warned of “nuclear warheads” being launched across the country and instructed residents to stock up on food for three weeks and shelter in basements.

The Russian ministry said attackers had exploited a vulnerability in its app’s administrative panel, prompting officials to disconnect and isolate affected services. 

Developers of the Air Alert app in Ukraine said “unauthorized interference” had occurred and temporarily disabled push notifications and the app itself. 

Yurii Ihnat, a spokesman for the Ukrainian Air Force, said the hack had no impact on Ukraine’s security operations and that the Air Alert app is not affiliated with the country’s military command systems.

The hacks came as a temporary ceasefire expired at 10:59 p.m. Ukraine time on Sunday in and around Oleshky, a southern Ukrainian city that has been occupied by Russia since 2022. 

The truce, credited by both sides to U.S. first lady Melania Trump and Pope Leo, began on Oct. 27. It allowed humanitarian aid into the city and some civilians to evacuate. Ukraine’s human rights commissioner Dmytro Lubinets said both sides had observed the agreement and were discussing further humanitarian measures.