Ukraine and Russia's emergency apps hacked within hours, fake nuclear alerts spread

Ukraine's Air Alert app was hacked on the evening of November 1, 2026, sending false warnings to millions of users. The compromised app issued red-level air raid alerts nationwide, with additional notifications warning of radiation hazards, chemical attacks, and street fighting in Kyiv. Some messages were written in Russian, which many users recognized as a sign of inauthenticity. Ukraine's Air Force confirmed the breach on Telegram, stating the app had been "subjected to hostile interference," and the government temporarily disabled the service for maintenance. App developers said unauthorized parties had interfered with operations and that they were working to restore service and implement additional security measures.

Hours later, Russia's Emergency Situations Ministry reported a similar cyberattack on its mobile alert app in the early hours of November 2. Russian users received fake notifications warning of nuclear warheads launched toward multiple regions, with some alerts falsely claiming the weapons were carried by P1-SUN Ukrainian-made FPV interceptor drones. The alerts, which included informal language and profanities, instructed residents to stockpile food for three weeks and seek shelter in basements. The fake alerts appeared not only in the app but also on regional ministry channels and operational headquarters accounts across Russia, including in St. Petersburg, Moscow, Belgorod, and other regions. Russia's emergency ministry emphasized the app was only a supplementary service and stated full functionality would be restored by day's end.

Neither government claimed direct responsibility for the attacks. A pro-Kremlin Russian Telegram channel called Mash reported speaking with a group called Hitcorecorp, which allegedly claimed responsibility for the Ukrainian hack, though NBC News could not verify this claim. A Ukrainian partisan group called Atesh shared screenshots of the Russian fake alerts. Cyber experts told the BBC that informal language in both hoax alerts pointed toward hacktivist groups rather than formal state-directed operations, and suggested the attackers may have deliberately delayed the Russian breach until after compromising Ukraine's system.

The incidents occurred hours after a six-day localized ceasefire in the Kherson region officially ended at 11 p.m. local time on November 1. The temporary pause, which involved the evacuation of hundreds of residents from the occupied town of Oleshky, had been widely reported as brokered with involvement from U.S. first lady Melania Trump and Pope Leo XIV. Russia resumed military operations in the Kherson region shortly after the ceasefire expired.

Many Ukrainians did not panic over the fake alerts, with some sharing memes online mocking the obvious falsity of warnings issued in Russian. Ukrainian security officials urged the public to consult only official channels and avoid clicking suspicious links. In Russia, there was no reported widespread panic, and the incident received limited media coverage. Kremlin spokesman Dmitry Peskov did not address the specific breach but noted that Russian government internet resources face constant cyberattacks, citing the proliferation of artificial intelligence as contributing to increased attack volume.