Hackers breached emergency alert apps in Ukraine and Russia overnight on Sunday, sending millions of citizens fabricated warnings about incoming nuclear strikes and chemical contamination. The digital intrusions targeted civil defence mobile software on both sides of the front line, prompting developers to suspend notifications and officials to clarify that their primary warning systems remained secure.
Key points
- Kyiv residents received spoofed alerts warning of radiation threats, chemical warfare and Russian ballistic missile strikes.
- A Ukrainian hacking collective retaliated hours later by tampering with Russia’s civil defence application to broadcast fake nuclear alarms.
- Developers disabled push services to contain the breaches, though both governments stated their core warning networks were unaffected.
- The dual breaches highlight growing software vulnerabilities in the digital warning infrastructure relied upon by civilians in wartime.
Intrusion hits Ukraine’s Air Alert service
Late on Sunday night, smartphone screens across Kyiv lit up with urgent civil defence alarms. Instead of standard warnings about incoming loitering munitions or cruise missiles, the messages warned residents of an imminent chemical hazard, street fighting in the capital, and potential radioactive fallout. The alerts originated from Air Alert, the primary mobile utility used by citizens to track aerial danger.
One message, composed in Russian, claimed that armed forces were launching an Oreshnik intermediate-range ballistic missile capable of carrying nuclear warheads. The notification embedded a web link to a Telegram channel run by a group identifying itself as Hitcore Corp, which claimed responsibility for the cyberattack. The fake warning used the authentic audio chime and recorded vocal prompts normally reserved for genuine military bombardments.
Ukraine’s Air Force intervened on official channels to confirm that the software had been compromised by hostile operators. Ukrainian security technology company Ajax Systems, which developed the application alongside the Ministry of Digital Transformation, rapidly disabled push notifications and suspended user access to contain the unauthorized broadcasts.
“Today, unauthorized individuals interfered with the app’s operation,” the developers stated on Sunday evening. The technical team confirmed that the platform stores no personal user data or location history and urged civilians not to open external links displayed in rogue messages. By Monday morning, engineers had begun restoring basic services, reactivating baseline alert sounds while keeping real-time danger maps offline during code reviews.
Retaliatory breach targets Russian civil defence app
Hours after the Ukrainian network suffered its disruption, pro-Ukrainian operators staged a counterattack against Russian emergency services. A cybersecurity group calling itself DC8044 claimed responsibility for breaching the official mobile client maintained by EMERCOM, Russia’s Ministry of Civil Defence, Emergencies and Disaster Relief.
The collective, which operates as an independent hacking network based in Kyiv, stated that it gained administrative command through the software’s application programming interface, or API. The group posted technical logs and intrusion details to demonstrate how it bypassed authentication checks to generate rogue broadcasts.
Through the compromised interface, the hackers transmitted urgent civil defence bulletins across Russian regional channels. The fake alerts informed recipients that nuclear warheads were travelling towards Russian territory, instructing civilians to collect emergency food rations, fill water containers, and evacuate immediately into basement shelters.
Russia’s Emergency Situations Ministry acknowledged the security breach on Monday, confirming that unauthorized parties had exploited the software. However, the ministry insisted that the compromise was confined entirely to the third-party client layer.
“The hacking of the mobile app has not affected and cannot affect the operation of the public warning system,” the ministry said. Russian authorities confirmed that primary siren arrays, television overrides, radio transmitters, and automated telecommunications SMS broadcasts remained fully operational and uncompromised.
The scale of civilian warning networks
Civilian warning utilities have become vital national infrastructure since the full-scale invasion of Ukraine began in February 2022. The Ukrainian government launched the Air Alert platform during the opening days of the war to replace regional air raid sirens that could not be heard indoors or during power outages.
The system expanded rapidly to provide automated, regional notifications on mobile devices. The software overrides silent switches on iOS and Android devices to ensure families wake up during nighttime drone and missile barrages. According to Ajax Systems, the application had 6.6 million active users as of January 2026, making it one of the most widely installed pieces of software in the country.
Because millions of people react immediately to these audible prompts by heading to bomb shelters and underground metro stations, manipulating the data feeds creates substantial societal disruption. Security officials noted that triggering mass panic or desensitising the public to genuine alarms represents a deliberate tactic in psychological warfare.
Ukrainian agencies moved swiftly to dampen public anxiety. The Center for Countering Disinformation told citizens that the alerts were fraudulent psychological operations, while the State Emergency Service confirmed its national warning sirens and cell broadcasts functioned as normal. Municipal officials also confirmed that municipal platforms, including the Kyiv Digital application, operated without interference.
A pattern of emergency broadcast exploits
Tampering with digital sirens and public alert channels has become a frequent weapon in modern hybrid conflicts. When military forces mount physical strikes on power grids or transport hubs, allied cyber units frequently probe secondary communications pipelines to magnify confusion.
In early 2023, cyber operators compromised satellite and automated playback infrastructure feeding Russian commercial radio stations. Broadcasters across several regions abruptly cut their scheduled programming to transmit synthetic siren sounds and synthetic voice recordings warning of an imminent missile strike, urging listeners to seek fallout shelters.
Similar vectors have appeared in other regional conflicts. During the outbreak of hostilities in the Middle East in 2023, cyber intelligence analysts documented how the hacktivist entity AnonGhost hijacked Red Alert: Israel, an emergency application that tracks incoming rocket salvos. The group exploited flaws in the server architecture to broadcast false notifications claiming that a nuclear strike had been initiated.
The incidents in Kyiv and Moscow demonstrate that while national sirens and hardware broadcasts remain insulated from public internet backbones, modern consumer apps remain susceptible to compromised API endpoints, push token leaks, and authentication failures.
What happens next
Engineers at Ajax Systems have implemented stricter transmission controls and revoked exposed API credentials while reviewing their notification pipeline. Full map tracking capabilities within the Air Alert software are scheduled to return once secondary audits finish.
Russian emergency administrators have similarly restricted mobile API traffic to contain further unauthorized broadcasts, relying on municipal loudspeaker masts and terrestrial television overrides to deliver civil protection notices.
