Hacked Alert Apps Send False Nuclear and Chemical Warnings in Ukraine and Russia

Emergency alert apps used by civilians in Ukraine and Russia were hacked hours apart overnight from Sunday into Monday, issuing false warnings about nuclear strikes and other dangers. The apps normally notify residents of approaching missiles, drones and other military threats, helping people decide when to seek shelter.

In Ukraine, the Air Alert app began sending false notifications at 10:47 p.m. local time on Sunday. The messages warned of radiation, chemical threats, a nuclear attack and street fighting in Kyiv. Ajax Systems and Stfalcon developed the app with support from Ukraine's Ministry of Digital Transformation.

The Ukrainian Air Force posted statements across multiple platforms at 11:02 p.m. local time confirming that the warnings were false. In a Telegram message, it said the app appeared to have suffered hostile interference and stressed that there was no radiation threat. It asked residents to stay calm and follow official updates.

Some Kyiv residents told CBS News that checking Telegram channels quickly helped them recognize the alerts as fake. Alongside the app, many Ukrainians use Telegram for information about incoming attacks. The Ukrainian Air Force and security analysts publish more detailed information about approaching strikes on the platform.

The developers of Air Alert acknowledged unauthorized interference and temporarily switched off both push notifications and the app. Ukrainian Air Force spokesman Yurii Ihnat said the breach did not affect Ukraine's security operations. He also said the civilian warning app was separate from the country's military command systems.

Russia's Emergencies Ministry app was subsequently hacked at 2:45 a.m. Moscow time. According to Russia's tightly controlled media, users across 33 regions received false warnings that nuclear warheads were being launched around the country. The messages also directed people to gather enough food for three weeks and take cover in basements.

The Russian ministry said the attackers gained access through a vulnerability in the app's administrative panel. Officials responded by disconnecting and isolating the affected services. The incidents disrupted warning tools intended to provide civilians with information about potential threats.

Separately, a truce that began on Oct. 27 had allowed humanitarian aid to reach Oleshky, a southern Ukrainian city occupied by Russia since 2022, and enabled some civilians to leave. Ukraine's human rights commissioner, Dmytro Lubinets, said both sides had respected the agreement and were discussing additional humanitarian measures.