Alert apps in Ukraine and Russia hacked within hours of each other
· BehindLines newsroom · Updated
In the night from Sunday 1 to Monday 2 November 2026, official public alert apps pushed out false warnings in Ukraine and then in Russia. According to the Ukrainian air force, as reported by ABC News, the national air raid alert app briefly showed fake nuclear, chemical and street-fighting threats for Kyiv. A few hours later, Russia's Emergencies Ministry acknowledged that a comparable app had come under cyberattack. At the time of the articles consulted, neither case had a confirmed culprit.
What happened on the Ukrainian side
According to the Reuters transcript, the Air Alert app began sending its erroneous messages shortly before the Oleshky truce expired. They mentioned a radiation risk, a chemical threat, a nuclear attack and fighting in the streets of the capital. About fifteen minutes later, the air force wrote on several platforms that the app "appears to have been subjected to hostile interference" and that there was "no radiation threat". It asked the public to stay calm and follow its official channels.
The app's developers, who built it with support from the Ministry of Digital Transformation, spoke of a cyberattack and temporarily suspended notifications, then the app itself. The ministry said other alert methods, including sirens, were still working. The air force said, according to CBS News, that the incident did not affect its security operations.
According to Reuters, some Russian-language messages claimed the whole country was under nuclear alert and mentioned the Oreshnik missile.
An attack reported in Moscow, with no established link
According to ABC, citing the state agency TASS, Russia's Emergencies Ministry said its mobile app, designed to warn of threats such as drones, had been hit by a "massive cyberattack" and that teams were working to restore it. CBS News adds, based on Russian state media, that false messages reached users in 33 regions. They announced the launch of "nuclear warheads" across the country and advised people to stock food for three weeks and shelter in basements. The ministry reportedly explained that the attackers had exploited a flaw in the administration panel, leading it to disconnect and isolate the affected services. These Russian details come from official or state-controlled sources and have not been independently verified.
The outlets consulted stress that it is not known whether the two incidents are connected. Ukraine's Centre for Strategic Communications (SPRAVDI) accused Russia in a post on X; this is a Ukrainian attribution that ABC does not present as confirmed, and no reaction from Moscow to the accusation is reported.
Background: the end of a local truce
The first false Ukrainian alerts came a few minutes before the expiry of a limited ceasefire around Oleshky, a city in the Kherson region occupied by Russia since 2022. The pause began on 27 October; ABC recalls that it allowed humanitarian aid in and hundreds of stranded residents out. According to Reuters, it expired late that evening, on 1 November. The closeness in time does not establish any link between the truce and the cyberattacks.
On the Ukrainian side, a senior figure cited by ABC (via AFP) says Russia refused to extend the truce, and Ukraine's General Staff accuses it of using it to rotate and resupply its troops, according to Reuters; Kremlin spokesman Dmitry Peskov replies that Kyiv could also have used it to regroup, according to Reuters. Attacks resumed on Monday around Kherson, where a drone injured two people in a vehicle, according to local authorities. ABC also recalls that U.S.-mediated Russia-Ukraine talks are due to resume this month, after being almost entirely frozen since the joint U.S.-Israeli strikes on Iran in February.
Key points
The new fact is the cyber incident itself. The Oleshky truce, which began in late October, and the freeze in negotiations are older elements, recalled here to place the event in context. Still unanswered are who was responsible, how many people received the false messages, and whether the two attacks are linked. The episode mainly shows the vulnerability of civil protection tools used every day, and the importance of redundant information channels such as sirens or official messaging services.