False warnings of air raids, chemical strikes and nuclear attacks flashed across emergency alert apps in Ukraine and Russia overnight, sowing brief alarm as a local ceasefire in southern Ukraine came to an end.
The cyberattack coincided with the expiry of a six-day truce brokered by US first lady Melania Trump in a small part of southern Ukraine. It was the longest pause in fighting since Russia launched its full-scale invasion in 2022.
- Advertisement -
Ukraine’s public air raid app began issuing bogus alerts shortly before 11pm (9pm Irish time) last night across Kyiv and other regions. The messages warned of radiation and chemical attacks, while some also cautioned residents about possible street fighting.
Several hours later, Russia’s state news agency TASS quoted the Emergencies Ministry in Moscow as saying that its own mobile application had also been targeted in a cyberattack, resulting in the transmission of fake public warnings.
One alert in Ukraine claimed that Russia had fired a hypersonic Oreshnik missile, a weapon capable of carrying a nuclear warhead, and that a nuclear emergency had been declared.
Ukraine’s air force said soon afterwards on the Telegram messaging app that the alert system appeared to have been compromised by Russia. It pointed out that the warnings were delivered in Russian, even though Ukrainian is required for all official communications in the country.
“The air alert app appears to have been subjected to enemy influence,” the air force said. “There is no radiation threat! Stay calm and follow our updates on our channel!”
All-clear notices followed each warning shortly afterwards. Ukraine’s Ministry for Digital Transformation said the application had been temporarily taken offline, while other public warning systems remained operational, including air raid sirens.
Evacuees from Russian-occupied Oleshky react as they arrived in Ukraine over the weekend
Ukraine is facing a critical shortage of air defence systems, with US-made Patriot interceptors regarded as its only effective protection against Russian ballistic missiles.
The US announced a $2.1bn agreement on Friday to provide Ukraine with 500 Patriot interceptors. However, two people briefed on the decision said delivery of the missiles could take years.
Residents of Kyiv appeared to minimise the effect of the cyberattack on the streets today.
Artem Pyndyk, a 37-year-old businessman, said the messages initially caught him off guard before he realised they were false.
“This didn’t trigger the kind of reaction in society that they expected,” Mr Pyndyk said, adding that relatives and friends he had contacted had not panicked either.
“You can laugh about it but, on the other hand, they gained a certain level of access and were able to hack the programme.”
Oksana Vostrykova, 48, was similarly unconcerned by the incident.
“I am calm about it, I kind of immediately understood that it might be a false message,” said the restaurant employee. “You worry more not for yourself but for your children who are nearby.”
Russian ministry says its app was also hit
Atesh, a pro-Ukrainian hacking group, shared a screenshot early today of the warning displayed in Russia on its Telegram channel, alongside a message stating: “The Ministry of Emergency Situations app has been hacked!”
The Moscow ministry sought to limit concerns, saying the application was not among its primary public warning channels but served only as a supplementary source of information.
A fake alert viewed by Reuters did not try to replicate an official notice. Instead, it used colloquial language, profanities and insults directed at Russia, referring to the country’s regions as “swamps”.
The message falsely claimed that nuclear warheads had been launched at every Russian region and urged people to gather three weeks’ worth of food and take shelter in their cellars.
The Russian ministry said specialists were working to return the application to normal operation.
“We ask the public to remain calm and to trust only official sources of information – the Russian Ministry of Emergency Situations’ website and the department’s official social media accounts,” it said.
