The Ukrainian Air Force reported that a public air raid alert mobile application was hacked late on Sunday, November 1, sending erroneous emergency notifications to users. The alerts, which appeared on smartphones starting at approximately 10:47 p.m. local time, falsely warned of nuclear, chemical, and radiation threats, as well as active street combat in Kyiv and other regions. The Air Force and the Main Directorate of Intelligence (GUR) clarified that there was no radiation threat and urged the public to remain calm while following official communication channels.
The incident occurred as Ukraine continues to defend against a full-scale invasion by Russia, a conflict that has lasted more than four and a half years. The "Air Alert" app, which is supported by the Ministry for Digital Transformation, is designed to provide immediate notifications regarding the start and end of defense alerts. During the disruption, the Ministry for Digital Transformation stated that while the app was not in operation, other public warning systems, including physical air raid sirens, remained functional.
According to logs reported by the BBC, the first false message at 10:47 p.m. declared a "Radiation threat" in Kyiv. One minute later, a message in Russian stated, "There will be a nuclear alert across Ukraine. Don't worry, it's Oreshnik flying," referring to a Russian hypersonic missile. Subsequent alerts warned of a chemical attack and active street fighting in the capital. The Main Directorate of Intelligence (GUR) noted that the false radiation hazard signal was also broadcast via loudspeakers in the Lviv region due to the app's interference. Natalya Zabolotna, governor of the Vinnytsia oblast, characterized the event as a cyberattack and cautioned citizens against clicking links contained in the messages.
The concrete day-to-day change for users was an immediate series of contradictory notifications on their smartphones, followed by "all clear" messages for each false threat. Residents in the Lviv region also experienced audible false alarms via public loudspeakers. Officials have instructed the public to verify all emergency information through multiple official sources, such as the Air Force Telegram channel, to distinguish between legitimate defense alerts and "hostile interference."
The hack sets a precedent for the vulnerability of digital infrastructure used for civil defense during active warfare. It demonstrates that cyber operations can be used to bypass traditional military alerts to reach the personal devices of civilians. What happens next involves technical investigations by the Ministry for Digital Transformation and security agencies to secure the application's infrastructure. While the abnormality eventually disappeared from the app, officials have not yet announced a specific date for a full security audit or when the app will be considered fully restored to service.