Fake Nuclear Alerts on Both Sides: Hackers Hijack Ukraine's Air Alert App, Then Russia's EMERCOM App — and Zelensky Confirms Ukraine Hacked Back
Within hours, Ukraine's Air Alert app and Russia's emergency ministry app pushed fake nuclear warnings to civilians; Zelensky openly confirmed Ukraine's retaliation.
What Happened
Ukraine and Russia hacked each other's emergency alert apps within hours of each other. Both attacks pushed fake nuclear warnings to civilians' phones.
On the evening of Sunday, 1 November 2026, users of Ukraine's "Air Alert" app, which millions of people rely on for air-raid warnings, started receiving alerts that did not come from the military. The fake notifications warned of a radiation hazard, a chemical threat and street fighting in Kyiv. One message, written in Russian, read: "Hi! There will be a nuclear alert across all of Ukraine right now! Don't worry, the Oreshnik is coming!" It was a reference to Russia's intermediate-range ballistic missile.
In the early hours of 2 November, it was Russia's turn. A mobile app run by Russia's Ministry of Emergency Situations (EMERCOM) sent users notifications claiming that "nuclear warheads" had been launched at all regions of the country. According to the attackers, the messages also told residents to stock up on food and shelter in basements.
Zelensky Confirms the Hack-Back
In an interview with a US broadcaster on 2 November, President Volodymyr Zelensky confirmed that Ukraine was behind the attack on the Russian app. He called it a direct response.
"They attacked our system. It was a cyberattack," he said. "We only respond to their attacks." Zelensky said Ukraine decided to respond once it was clear the attack was aimed at civilians.
It is rare for a head of state to openly confirm an offensive cyber operation, and rarer still to frame it as a tit-for-tat reply to a specific incident.
Who Claimed What
The attribution picture is messy:
- Kyiv breach: A previously unknown group calling itself Hitcore Corp claimed the Air Alert attack on Telegram. Ukraine's Air Force said the app had "likely been compromised by the enemy," and Ukraine's Center for Strategic Communications blamed Russia, pointing to the Russian-language message. No technical evidence linking the attack to a Russian state unit has been published.
- Moscow breach: A group calling itself DC8044, which describes itself as an independent cybersecurity and hacking community based in Kyiv, claimed the EMERCOM attack. The group says it got in through the app's API.
Neither side's attribution has been independently confirmed.
The Damage and the Response
In Ukraine, the app's developers said "unauthorized individuals interfered with the app's operation." They stressed that the app stores no personal information and told users not to open links in suspicious notifications. Push notifications were temporarily disabled and then restored. The Air Force said there was no radiation threat. The national warning system, including the sirens, kept working throughout, and the Ministry of Digital Transformation told people how to keep getting real alerts while the app was down.
In Russia, EMERCOM confirmed that "hackers managed to send fake information to the public" but said the hacking of the app "has not affected and cannot affect the operation of the public warning system." It described the app as only a supplementary source, with real warnings still delivered by sirens, loudspeakers, text messages, TV and radio.
Neither side has said how many people received the fake alerts.
Why It Matters
Emergency alert apps are trusted, high-attention channels. People are trained to act on them immediately, which is exactly what makes them valuable to attackers. A single compromised push channel can reach millions of phones in seconds with a message carrying official credibility.
This episode shows several things:
- Alert apps are now war targets. Both apps sat beside, not inside, the core national warning systems, and that separation is what limited the damage. But to the person holding the phone, the app is the warning system.
- The weak point is the delivery layer. The Russian app was reportedly hit through its API. Push services, admin panels and API keys behind alert apps deserve the same protection as the sirens themselves.
- Fake alerts are psychological operations. Neither attack needed to destroy anything. The aim was fear, confusion and erosion of trust in future warnings, which is dangerous in a country where real air-raid alerts save lives daily.
- Open retaliation changes the norms. A president publicly confirming a revenge hack makes offensive cyber operations against civilian-facing systems part of the open conflict playbook, not a deniable sideshow.
Lessons for Anyone Running Alert or Notification Systems
- Lock down the send path. Require multi-person approval and strong, phishing-resistant authentication for any action that can broadcast to all users.
- Protect API keys and push credentials (FCM/APNs keys, admin tokens). Rotate them, restrict them by IP, and keep them out of client apps and code repositories.
- Rate-limit and anomaly-check broadcasts. A burst of high-severity alerts outside normal patterns should be blocked or held for human review automatically.
- Sign and template critical alerts so the app only displays messages that match approved formats from verified sources.
- Have a kill switch and a fallback channel, and tell the public in advance which channel is authoritative if the app is ever compromised.
- Rehearse the "fake alert" scenario, including how fast you can publicly retract a false warning.
Analyst Take
The incidents were short-lived and the core warning systems held on both sides. But the bar has moved. Hacking civilian alert apps to send fake nuclear warnings is now an openly acknowledged tactic in the Russia–Ukraine war, confirmed from the top. Any government or company running a mass-notification app should assume it is a target and harden the broadcast path accordingly.
