Jens Asbjørn Bøgen
The sirens were activated in multiple regions following the hack.
For most of the war, the little chime from Ukraine’s air raid app has meant one thing: get to a shelter.
Late on Sunday, the same app pushed something far more frightening across phones from Kyiv to the far western border, and the message was not from the people who built it.
Users of the Air Alert application saw a notification in Russian that read: “Hi! A nuclear alert is about to go off all across Ukraine! Don’t worry, the Oreshnik is on its way,” according to BNO News. Sirens activated in multiple regions, including Zakarpattia Oblast in the far west of the country.
Ukraine’s Air Force said late on November 1 that the alert system had been compromised. “The air alert app appears to have been subjected to enemy influence,” the service said, as reported by Reuters, telling residents there was no radiation threat and to follow updates on its Telegram channel.
What the fake alerts claimed
The spoofed notifications warned of nuclear and chemical threats, and in some cities of street fighting and artillery fire. The app displayed nuclear and chemical hazard warnings along with a street-combat alert for Kharkiv, Ukraine’s second-largest city, and street-fighting and artillery-fire alerts for Zaporizhzhia in the southeast.
The Oreshnik reference is loaded: it is the name Russia uses for a ballistic missile Moscow has previously fired at Ukraine and which the Kremlin has described as nuclear-capable. Dropping it into a fake alert is a direct play on the Ukrainian public’s deepest fear.
The Air Alert app was developed by Ajax Systems and Stfalcon with support from Ukraine’s Ministry of Digital Transformation, and is the country’s main officially endorsed mobile warning channel.
System restored within about an hour
The false notifications were cleared in roughly an hour. By midnight local time, Ukraine’s State Emergency Service reported that the nationwide alert system had been restored, BNO News reported.
Officials also warned that the incident could be paired with phishing, telling users not to click links in suspicious messages or forward unverified claims. The Ministry of Digital Transformation said the Air Alert app itself was offline during the incident while other alerting channels, including physical air raid sirens, kept working, Reuters reported.
No group has claimed responsibility. The Air Force attributed the compromise to “enemy influence,” the shorthand Ukrainian officials use for Russian state-linked activity, without naming a specific actor.
