Hackers hit Ukrainian and Russian emergency alert apps hours apart

KYIV — Hackers breached the mobile applications that warn civilians of incoming missile, drone, chemical and nuclear threats in both Ukraine and Russia within hours of each other late Sunday and into Monday, each attack flooding millions of phones with false alarms just as a rare five-day ceasefire around the Kherson-region town of Oleshky expired and fighting resumed along the front.

False alarms spread within hours of each other

Ukraine's Air Force said late Sunday that Air Alert, the country's main public warning app, had sent fabricated notifications of a nuclear strike, a chemical attack and street fighting in and around Kyiv, with sirens sounding in several regions even though no genuine threat existed. One of the false messages, written in Russian, warned that Russia's nuclear-capable Oreshnik missile was inbound. A previously unknown group calling itself Hitcore Corp claimed responsibility in a Telegram channel linked from inside one of the fake alerts, according to reporting by The Record, the news service of the cybersecurity firm Recorded Future.

Ajax Systems, the private developer that built Air Alert with the backing of Ukraine's Ministry of Digital Transformation, disabled push notifications and suspended the app Sunday night, saying "unauthorized individuals interfered with the app's operation" and that no personal data was stored or exposed. The service began a gradual restart around 2 a.m. Monday, though its live threat map remained offline while engineers added security measures. Ukraine's State Emergency Service said by midnight that the country's wider warning network, including sirens, loudspeakers and the separate Kyiv Digital app, was functioning normally and urged residents not to click unfamiliar links.

Hours later, early Monday, a group calling itself DC8044 — which describes itself as an independent, Kyiv-based hacking and cybersecurity community — claimed on Telegram that it had broken into the mobile app run by Russia's Ministry of Emergency Situations, known as EMERCOM or MChS, through its administrative interface. Russia's Ministry of Emergency Situations confirmed the breach on its own website, saying attackers compromised the app's control panel and used it to push a false message to residents of 33 Russian regions at roughly 2:45 a.m. Moscow time, falsely claiming that nuclear warheads had been launched and urging people to stockpile three weeks of food and shelter in basements.

A ceasefire collapses into cyberwarfare

The dueling hacks landed at a pointed moment. A localized humanitarian ceasefire around the Russian-occupied town of Oleshky in Kherson region — brokered in talks the White House credited in part to first lady Melania Trump — had taken hold on October 27 to allow aid deliveries and the evacuation of roughly 2,000 residents who wanted to leave. It was, by multiple accounts, the longest sustained lull of the war along that stretch of front, and it expired at 10:59 p.m. Monday local time. Russian shelling around Kherson resumed almost immediately afterward, according to Al Jazeera's reporting from the region, and the alert-app intrusions followed within hours.

Ukraine's Centre for Strategic Communications, known by its Ukrainian acronym SPRAVDI, blamed Russia for the Air Alert breach without providing technical evidence. Ukraine's Air Force was more measured, saying only that the app "appears to have been subjected to enemy influence." Moscow's emergencies ministry, for its part, did not name Ukraine or any other party in its public statement, though the DC8044 group's claimed retaliation came hours after the Ukrainian breach and described itself explicitly as Kyiv-based.

"The air alert app appears to have been subjected to enemy influence," Ukraine's Air Force said in a statement, adding that there was no actual radiation or chemical threat.

Neither government's account has been independently verified by outside forensic investigators, and both main claims of responsibility — Hitcore Corp on the Ukrainian side and DC8044 on the Russian one — are self-published assertions rather than confirmed attributions. Fabricated air-raid warnings have circulated in the war before: Russian regional radio and television broadcasts were hijacked to transmit false nuclear-alert messages in February 2023, an episode Moscow also blamed on hackers.

Millions of users, a cyber-resilience push already underway

The scale of potential exposure is large on both sides. Air Alert has roughly 6.6 million active users, according to figures cited by The Record, and is one of the principal tools Ukrainians use to track incoming Russian missile and drone attacks across the country. EMERCOM's app, which covers a nuclear-armed state of more than 140 million people, was compromised widely enough to require a public statement of reassurance; Russia's ministry said on its site that the country's underlying public alert system — sirens, SMS, television and radio — remained unaffected and fully operational even as the app itself was taken offline for repairs.

The incident also lands as Ukraine is pouring fresh resources into defending exactly this kind of civilian digital infrastructure. Hours after the hack became public, Ukraine's Ministry of Digital Transformation announced that international partners had committed more than €32.4 million this year to projects protecting Ukraine's civilian and critical infrastructure from cyberattacks, under a framework known as the Tallinn Mechanism. The coalition, created by Ukraine's partners in December 2023 and now including roughly fifteen countries along with the European Union, NATO and the World Bank as observers, held its tenth coordination meeting in Rome on the same day the alert apps were compromised.

Deputy Digital Transformation Minister Vitaliy Balashov told that meeting that Russia had carried out more than 30 "kinetic" strikes on Ukrainian data centers over the preceding two months alone, framing cyberattacks on civilian infrastructure as an increasingly routine component of what Ukrainian officials call hybrid warfare. Civilians who rely on the compromised apps for early warning of real strikes are the most immediately affected group, since any erosion of trust in the alert systems — or any lag in restoring full functionality — could leave people slower to react to a genuine attack.

Officials trade blame as repairs continue

By Monday afternoon, both ministries said core services were being restored. EMERCOM said the compromised app's full functionality would return by the end of the day and that it had reported the intrusion to Russia's National Coordination Center for Computer Incidents, the state body that handles major cyber incidents. Ukrainian developers said they were adding unspecified new security measures to Air Alert before fully reinstating its map and targeting features. Kremlin spokesman Dmitry Peskov, asked about the episode, said Russian government websites, including the presidential site, face frequent attempted intrusions as a matter of course, without directly addressing the EMERCOM breach.

Regional Ukrainian officials sought to calm residents in the interim. Vinnytsia's regional governor warned that the false alerts might have been paired with phishing links and urged people not to tap on unfamiliar messages inside the app. Kyiv authorities separately confirmed that the city's own Kyiv Digital notification system, developed independently of Air Alert, was not affected and continued operating normally throughout the incident.

What comes next

Neither Kyiv nor Moscow has signaled any plan for a joint or independent technical investigation, and both governments' public statements so far rest on the self-published claims of hacking groups rather than confirmed forensic findings. Ukrainian officials have given no timeline for fully restoring Air Alert's map feature beyond "soon," while EMERCOM has set its own repair deadline at the end of Monday. The bigger test is likely to come with the next real missile, drone or artillery barrage: both countries' warning systems will need to perform without further disruption at the moment they are needed most, even as the brief calm around Oleshky gives way to renewed fighting across Kherson region. The Tallinn Mechanism's donors, meanwhile, are due to hand coordination of the civilian cyber-resilience coalition from Italy to Norway and Finland at the start of 2027, a transition that Ukrainian officials say will shape how quickly additional funding reaches projects like the ones meant to harden exactly the kind of apps that were compromised this week.