Air Alert App and MChS App Hacked to Push Fake Alerts

Ukraine’s Air Alert app was hacked on the night of 1 November and used to push false warnings of radiation, chemical and nuclear threats, but the country’s sirens and state alert system kept working, and the developers switched the push notifications off within hours. A few hours later, Russia’s Emergencies Ministry (MChS) said its own mobile app had suffered a “massive cyberattack” that let attackers send fake information to the public.

Both hacks are confirmed by the bodies that run the apps. Who carried them out is not. Ukraine’s Centre for Strategic Communications blames Russians, and a pro-Ukrainian group publicised the Russian hack, but neither claim has been independently confirmed.

In brief

Ukraine’s Air Alert app and Russia’s MChS app were both hacked on 1–2 November to send fake alerts.
In both countries, officials said sirens and the national alert systems kept working normally.
Who was behind the hacks is claimed but not independently confirmed.

How Ukraine kept the Air Alert app hack contained

According to the BBC, the false alerts began at about 22:47 Kyiv time (20:47 GMT) on Sunday, with a radiation warning for Kyiv followed by a Russian-language message about a nuclear alert, then chemical and street-fighting warnings. None of these threats was real.

The official response came quickly. At 21:02 GMT, the Ukrainian Air Force posted on its Telegram channel that the Air Alert app had “probably been subjected to enemy influence”, adding: “There is no radiation threat! Stay calm and follow our messages on our channel!” (TSN translation). The Ministry of Digital Transformation repeated the warning four minutes later.

The ministry then told people how to get alerts while the app was down. It said phones’ built-in emergency alerts, which sound even in silent mode, should be switched on, and that “sirens and other alert systems are working”. It added that air alert notifications in the Kyiv Digital city app were working normally.

The State Emergency Service, DSNS, said at 22:00 GMT that the national alert system was “working normally”, with every threat signal still passed to regional administrations and on to street sirens. It urged people never to follow links in unverified messages. The BBC reported that the false alerts had also set off a radiation hazard signal on loudspeakers in Lviv region, though there was no radiation threat.

What the Air Alert app developers say

At 22:17 GMT, the Air Alert app team said on its official channel that “unauthorised persons” had interfered with the app. “We have disabled push notifications and temporarily suspended the app,” the team wrote (TSN translation). It said the Air Alert app does not store personal data, “so there is no threat to users”, and asked people not to click links in suspicious notifications.

By 23:52 GMT, the developers said they were gradually bringing the app back “after a cyberattack”. Yellow and red danger levels were back on the map and alert pushes were arriving again. Some map features were paused, and the team said it was adding protections to stop a repeat. It has not said how the attackers got in.

Russia’s MChS app hit hours later

At 03:30 Moscow time (00:30 GMT) on 2 November, MChS said on Telegram that its mobile app had been hit by a “massive cyberattack” that let attackers send “fake information” to the public. It said work was under way to fix the vulnerability and restore normal service.

Just under 90 minutes later, the ministry added that Russia’s public alert system was working normally and that the app hack “did not and cannot” affect it. Warnings still go out through sirens, loudspeakers, SMS, television and radio, it said, calling the app “only an additional, auxiliary” service.

Who is behind the hacks is still a claim

Ukraine’s Centre for Strategic Communications, SPRAVDI, wrote at 20:58 GMT that “Russians hacked” the Air Alert app, pointing to several unusual threats appearing at once and a caption in Russian. BBC Ukrainian reported that different groups of Russian hackers claimed responsibility.

On the Russian side, Moscow has not said who it blames. The Ukrainian outlet UNN reported that the pro-Ukrainian partisan group Atesh published a screenshot of a fake nuclear warning sent through the MChS app, and the BBC said a Ukrainian group claimed such warnings had reached Russian users. BBC Ukrainian said it could not verify the screenshot. None of these claims has been independently confirmed.

Neither government has published technical details. TSN has covered Ukraine’s wider cyber defence, from the order for every state body to form a cyber security team to a wiper attack on a Ukrainian grain firm that ESET linked to two Russian groups and a Belarus-aligned group’s wiper. In those cases, attribution came from investigators’ research rather than from claims made on the night.

Why sirens mattered more than the apps

The most useful fact from the night is that the apps failed and the alert systems did not. In Ukraine, the Air Force, the digital ministry and DSNS all said within roughly an hour of the first false alert that sirens and the state system were unaffected, and they pointed people to channels that still worked. In Russia, MChS made the same point about its own app.

That layered design is what kept a hacked app from turning into a public safety failure. An app adds detail and convenience, but it is only one route among several. When it was compromised, people could still rely on street sirens, phone emergency alerts and official channels, and officials told them so quickly.

The weak point is trust. A false warning that reaches millions of phones does damage even when it is corrected within the hour, because the next real alert may be doubted. Both sets of operators have said they are fixing the flaw, but neither has said how it was exploited, which leaves users unable to judge whether the risk has gone.

For anyone in either country, the practical lesson is simple: keep phone emergency alerts switched on, treat sirens as the final word, and check any shocking message against an official channel before acting on it. Until the developers explain how the Air Alert app was breached, the safest view of any alert app is as a useful extra, not the only warning.

Sirens Kept Working as Hackers Hit Ukraine and Russia Alert Apps

How Ukraine kept the Air Alert app hack contained

What the Air Alert app developers say

Russia’s MChS app hit hours later

Who is behind the hacks is still a claim

Why sirens mattered more than the apps

Sources

Related stories

Victoria’s SEC Signs 10-Year Deal for Planned Glenrowan Battery

Anthropic in Talks to Lease Beacon’s Alberta Data Centre Campus

Proton Cancels AI Re-Interviews and Denies Tracking Staff AI Code

National Grid Agrees Teesside Substation Land Deal at Dorman Point

Latest stories