Hackers Spoofed Emergency Apps in Ukraine and Russia on Sunday

Thirty-three Russian regions received false emergency alerts on Sunday night warning of nuclear warheads and chemical attacks.

The hack hit the app used by Russia's Emergencies Ministry at 2:45 a.m. local time in Moscow. Users in those 33 regions saw messages instructing them to stock up on food for three weeks and shelter in basements.

Ukrainian users received similar false warnings hours earlier. At 10:47 p.m. local time, the Air Alert app began sending push notifications about radiation, chemical threats, and street fighting in Kyiv.

The app, developed by Ajax Systems and Stfalcon with support from Ukraine's Ministry of Digital Transformation, was targeted by what developers called unauthorized interference. Officials temporarily disabled push notifications and the app itself after the breach.

The Ukrainian Air Force confirmed the alerts were fake at 11:02 p.m. local time. A message on Telegram stated, "The Air Alert app appears to have been subjected to hostile interference. There is no radiation threat!" The service urged citizens to remain calm.

Yurii Ihnat, a spokesman for the Ukrainian Air Force, said the hack did not impact security operations. He noted that the Air Alert app is not affiliated with the country's military command systems.

In Russia, the Emergencies Ministry said attackers exploited a vulnerability in the app's administrative panel. Officials disconnected and isolated the affected services to contain the breach.

These digital breaches occurred during a temporary truce in Oleshky, a southern Ukrainian city occupied by Russia since 2022. A missile strike hit the area at 10:59 p.m. Ukraine time on Sunday. The truce, which began on Oct. 27, allowed humanitarian aid to enter the city and enabled some civilians to evacuate. Dmytro Lubinets, Ukraine's human rights commissioner, stated that both sides observed the agreement and discussed further humanitarian measures.