Just before 11pm on Sunday, phones across Ukraine lit up with a message no one wants to read: a radiation threat in Kyiv, followed by a chemical attack warning and an alert about street fighting. None of it was real. A few hours later Russia said its own emergency app had been hijacked too, with users told that nuclear warheads were heading for every region of the country. On the same night, both sides’ official warning apps were turned into tools for panic.
Quick answer: On the night of 1–2 November 2026, hackers broke into Ukraine’s official Air Alert app and Russia’s Emergencies Ministry app and pushed fake warnings of nuclear, chemical and street-fighting threats. Both governments confirmed the breaches and said there was no real danger. Ukraine blamed Russia; nobody has credibly claimed the Russian hack. Sirens, TV, radio and text alerts kept working in both countries.
What happened in Ukraine
The Ukrainian target was Air Alert (also known as Air Alarm), the nationwide app Ukrainians use to know when Russian missiles or drones are on the way. It is supported by Ukraine’s Ministry of Digital Transformation.
Shortly before 23:00 local time on Sunday, 1 November, the app began sending nationwide red-level air raid warnings. Residents of Kyiv and some other areas then received a string of increasingly alarming messages. According to a timeline compiled by Security Affairs:
| Time (Kyiv) | Fake alert |
|---|---|
| 22:47 | Radiation threat declared in Kyiv |
| 22:48 | Russian-language message: a nuclear alert across all of Ukraine, “Don’t worry, it’s Oreshnik flying” |
| 22:49 | Ukrainian-language warning of a chemical attack on Kyiv, plus a message about street fighting |
| 22:50–23:57 | Red alert shown for Ivano-Frankivsk region, which was calm (per regional head Svitlana Onyshchuk) |
| 23:53 | All-clear messages sent for each Kyiv threat |
The reference to Oreshnik was no accident: it is Russia’s nuclear-capable intermediate-range hypersonic missile. Dropping its name into a casual, almost mocking message was clearly designed to frighten.
How Ukrainian officials responded
Ukraine’s Air Force posted on Telegram that the app “appears to have been subjected to enemy influence,” stressed there was no radiation threat, and asked people to stay calm and follow its official channel. The Ministry of Digital Transformation said it had temporarily disabled the app because it had apparently been compromised, adding that sirens and other alert methods were still working. The app itself said “outside individuals” had carried out unauthorised interference and paused notifications.
Ukraine’s Centre for Strategic Communications (SPRAVDI) blamed Russia and told residents to ignore “strange messages.” In Vinnytsia, regional head Natalya Zabolotna confirmed a cyberattack and warned people not to tap a link contained in the message, because it could be a phishing trap. Kyiv city authorities said their separate city alert app kept working normally.
Oleksander Merezhko, who chairs the Ukrainian parliament’s foreign affairs committee, told the BBC that the Russian-language text “gave them away” and caused no real panic. “It’s a very unpleasant fact but it is part of cyber war and people in Ukraine understand that,” he said.
What happened in Russia
Early on Monday, Russia’s Ministry of Emergency Situations said its mobile app had suffered a “massive cyberattack” and that hackers had managed to send “false information” to the public. Users received notifications claiming nuclear warheads had been launched at all regions of Russia.
A screenshot shared by the Ukrainian partisan group Atesh, and reported by Ukrainian outlet UNN, showed a fake alert claiming the warheads were mounted on Ukrainian P1-Sun attack drones. It told residents to stock up on three weeks of food and hide. Atesh shared the image but did not clearly claim to have carried out the attack, and no group has credibly taken responsibility.
The ministry said its wider public warning system was not affected and that real warnings could still reach people through sirens, loudspeakers, text messages, TV and radio. Russia’s state news agency TASS told citizens to rely on those channels while the app was being restored.
Why it is trending
“Russia cyber attack” jumped to more than 1,000 searches in the UK on Monday, according to Google Trends, as the BBC, NBC News, The Telegraph and others ran the story. The reasons are easy to see:
- Nuclear fear: any alert mentioning nuclear weapons grabs attention, even when it is quickly debunked.
- Both sides at once: this was not a one-way attack. Two hostile governments admitted on the same night that their own warning tools had been turned against their citizens.
- Timing: the Ukrainian alerts came minutes before a local ceasefire in the Kherson region expired.
- A warning for everyone else: almost every country now pushes emergency alerts to phones. This shows what happens when that channel is compromised.
The Kherson ceasefire context
The hack landed at a sensitive moment. A localised six-day ceasefire around the occupied town of Oleshky in the Kherson region was due to expire at midnight Moscow time that night. The National reported that the pause had been reached after mediation by US first lady Melania Trump, with Pope Leo involved, and allowed civilians to leave the town. Al Jazeera described it as the longest local pause in fighting since Russia’s full-scale invasion in February 2022.
No immediate resumption of fighting around Oleshky was reported. Elsewhere, Russia’s defence ministry said it struck a military facility in the Odesa region and a cargo vessel about 58km south of Odesa; a local official said four people were injured.
Key facts at a glance
| Ukraine | Russia | |
|---|---|---|
| App hit | Air Alert (Air Alarm) | Emergencies Ministry (MChS) app |
| When | Sunday 1 Nov, from about 22:47 | Late Sunday / early Monday 2 Nov |
| Fake messages | Radiation, chemical attack, street fighting, “Oreshnik” nuclear alert | Nuclear warheads launched at all regions; stock up on food and hide |
| Official reaction | App disabled; Air Force says no radiation threat; Russia blamed | Ministry confirms “massive cyberattack”; app being restored |
| Backup channels | Air raid sirens, Kyiv city app | Sirens, loudspeakers, SMS, TV, radio |
| Who did it | Unconfirmed; Ukraine blames Russia | Unclaimed |
Why this attack is unusual
Fake air raid warnings are not new in this war. Russian regional radio and TV stations have been hijacked in the past to broadcast bogus alerts. What is new is that the official app itself was used. Herbert Lin of Stanford University said it was likely the first time this had happened to an official Ukrainian information app.
That matters because an alert app is only useful if people trust it instantly. During a real attack, people may have only minutes to get to shelter. If they start wondering whether a warning is fake, the next real one could be ignored. Damaging that trust may be a bigger goal than the brief panic itself.
Neither government has explained how the intruders got in. There is no public information yet on whether attackers stole administrator credentials, compromised a third-party push-notification service, or exploited a software flaw. Until that is known, it is impossible to say whether the two hacks were linked or simply copycats.
Questions investigators will be asking
- Push-notification access: who can send alerts, and whether that access needs more than a password.
- Third-party providers: many apps rely on outside services to deliver notifications at scale.
- Phishing links: Vinnytsia’s warning suggests the fake messages may also have been used to harvest data.
- Language and timing clues: as Merezhko noted, a Russian-language message in a Ukrainian state app was an immediate red flag.
What happens next
Ukraine’s digital ministry is expected to bring Air Alert back once it is confident the breach is closed, and pressure will grow for tighter controls on who can push nationwide alerts. Russia’s ministry says it is restoring its app. Investigators will be looking for the entry point, and independent researchers will try to match the attack to known hacking groups.
For ordinary users in any country, the lesson is simple: emergency apps are important, but they should not be the only source. Cross-check alarming alerts with sirens, official social media channels, TV or radio, and never tap links inside an unexpected alert.
For more on recent events across Europe, see our Top 30 Europe news roundup for 26 October and the 25 October edition, including Starlink being restored.
Frequently asked questions
Was there a real nuclear or chemical threat in Ukraine or Russia?
No. Ukraine’s Air Force said there was no radiation threat, and Russia’s Emergencies Ministry said the messages were false information sent by hackers.
Which apps were hacked?
Ukraine’s official Air Alert (Air Alarm) app, supported by the Ministry of Digital Transformation, and the mobile app of Russia’s Ministry of Emergency Situations.
Who was behind the attacks?
It has not been confirmed. Ukraine’s Centre for Strategic Communications blamed Russia for the Ukrainian hack. No group has credibly claimed the Russian one, though Ukrainian partisan group Atesh shared a screenshot of the fake alert.
What does “Oreshnik” mean in the fake alert?
Oreshnik is a Russian nuclear-capable intermediate-range hypersonic missile. The fake message used its name to make the nuclear threat sound credible.
Are other alert systems still working?
Yes. Ukraine said sirens and other alert methods were working, and Kyiv’s city app was unaffected. Russia said sirens, loudspeakers, text messages, TV and radio could still carry real warnings.
Sources: Al Jazeera (with AFP and Reuters), The National, Meduza, Security Affairs (citing BBC), UNN, Google Trends.
