In brief
The Ukrainian Air Force said its air raid alert app was likely hacked, pushing false alerts that triggered nationwide sirens. Both Ukrainian and Russian officials addressed the incident, with Kyiv denying any real threat and Moscow acknowledging a massive cyberattack on its own app. The scare followed a brief ceasefire in Kherson, underscoring the ongoing cyber‑informational warfare in the conflict.
The Ukrainian Air Force announced on Sunday that its official "Air Alert" smartphone app had been hacked, sending false alarms that claimed nuclear and chemical threats and warned of a Russian Oreshnik hypersonic missile. The misleading alerts prompted air raid sirens across the country and created confusion among civilians in and around Kyiv.
The Air Force’s statement on Telegram confirmed the compromise, adding that "there is no radiation threat! Stay calm and keep an eye on updates on our channel." The false warnings also showed a wrong map location, with symbols indicating dangers such as radiation and chemical weapons appearing near Kyiv on the app’s graphics.
"There is no radiation threat! Stay calm and keep an eye on updates on our channel!"
Earlier that day, Ukraine’s Centre for Strategic Communications (SPRAVDI) posted on X blaming Russian actors for the hacking. The agency linked the incident to the broader cyber campaign it alleged Russia was running against Ukrainian communication infrastructure.
Separately, a Kyiv‑specific alert app reportedly functioned normally, allowing the city to maintain its standard warning procedures without interference.
On Monday morning, Russia’s Emergencies Ministry issued a statement on Telegram acknowledging that its own mobile app had been hit by a "massive cyberattack" that spread false information. The ministry did not confirm whether the false data on the Ukrainian app was also spread on its platform, but the timing of the two announcements hint at a coordinated effort.
"The attack led to the spread of false information."
Officials from both sides emphasized that there was no actual nuclear or chemical danger and urged citizens not to panic. The State Emergency Service of Ukraine released an all‑clear at midnight on Monday, noting that the national warning system was functioning normally and that all threat signals were being transmitted to regional administrations for relay to street warning systems.
Kyiv’s State Emergency Service urged people to follow official local authority updates and warned against clicking on unverified links or sharing unconfirmed data from third‑party sources.
Other events on the same Sunday included a wave of Russian missiles and drones targeting energy infrastructure in four Ukrainian regions—Dnipro, Vinnytsia, Zhytomyr, and Khmelnytskyi—leaving hundreds of thousands without power, according to President Volodymyr Zelensky’s statement. The UPI report also noted that Russian attacks on critical infrastructure continued unabated.
These cyber incidents and the physical missile attacks unfolded shortly after the recent end of a localized ceasefire in Kherson. The truce, which had been in effect since Tuesday, ended on Sunday and was the longest pause in fighting in that region to date.
While Ukrainian officials firmly attribute the hacking to Russian actors, Russia’s Emergencies Ministry has only acknowledged its own app’s compromise but has not directly implicated Russian forces in the Ukrainian breach. Both sides have also stopped short of confirming the deployment of the Oreshnik missile, and no evidence of such deployment has been publicly released.
Because both Ukrainian and Russian officials have avoided naming a direct responsible party for the hacking, it remains uncertain exactly who caused the false alerts, whether the Oreshnik missile claim was fabricated, and how this incident will affect future cyber and informational operations in the war.
