Hacked emergency apps send false nuclear warnings in Ukraine and Russia

Ukraine and Russia reported that their emergency alert apps were hacked overnight, sending residents false warnings about air raids and chemical and nuclear attacks. The incidents coincided with the expiry of a six-day local ceasefire in a small part of southern Ukraine, brokered by US first lady Melania Trump. It was the longest such pause in fighting since Russia began its full-scale invasion in 2022.

Ukraine's public air raid app began issuing the fabricated messages shortly before 11 p.m. on Sunday, or 2100 GMT. Alerts for Kyiv and other areas warned of radiation, chemical attacks and possible street fighting. One claimed Russia had fired an Oreshnik hypersonic missile, which can carry a nuclear warhead, and that a nuclear alert was in effect.

The Ukrainian air force said on Telegram that Russia appeared to have compromised the system. It pointed to the use of Russian in the warnings, since official communications in Ukraine must be in Ukrainian. The air force told residents there was no radiation threat and urged them to remain calm. Reuters could not establish who was responsible for the attacks. Experts have attributed earlier cybersecurity incidents during the war to activist hackers and intelligence agencies on both sides.

All-clear notifications followed each false Ukrainian alert. The Ministry for Digital Transformation said it had temporarily suspended the app, while air raid sirens and other public warning methods remained operational. The disruption came amid a critical shortage of Ukrainian air defenses, particularly US-made Patriot interceptors, its only effective defense against Russian ballistic missiles. Washington announced a $2.1 billion agreement on Friday to provide 500 interceptors, although two people briefed on the decision said delivery could take years.

Residents interviewed in Kyiv described little panic. Businessman Artem Pyndyk, 37, said the messages initially surprised him before he understood what had happened. Relatives and friends he contacted had also remained calm, he said, though he expressed concern that hackers had gained access to the app. Pizzeria employee Oksana Vostrykova, 48, said she immediately suspected a false message and worried more about nearby children than herself.

Hours after the Ukrainian alerts, Russia's TASS state news agency quoted the Emergencies Ministry in Moscow as saying its mobile app had also suffered a cyberattack. Early on Monday, the pro-Ukrainian hacking group Atesh posted a screenshot of a Russian alert on Telegram and said the ministry's app had been hacked.

The fabricated Russian message, viewed by Reuters, claimed nuclear warheads had been launched against every Russian region and advised residents to gather three weeks of food and shelter in cellars. Its colloquial language, profanity and derogatory references to Russia differed from an official communication.

Russia's Emergencies Ministry described its app as an additional information source rather than a principal public warning channel. It said specialists were working to restore normal service and urged residents to remain calm and consult its website and official social media accounts.