Emergency-warning applications in Ukraine and Russia have been targeted in separate cyber incidents that caused false nuclear and other danger alerts to reach members of the public, raising serious concerns about the security of systems used to warn civilians during wartime.
Ukraine's Air Force reported on Sunday, November 1, that the country's widely used Air Alert application appeared to have been compromised after users received alarming messages about radiation, chemical attacks and possible fighting in the capital, Kyiv.
Hours later, Russia's Emergencies Ministry announced that its own mobile application had suffered a major cyberattack, allowing attackers to distribute false information to the public.
Both developments have been confirmed through official statements reported by Reuters and regional news organisations.
However, authorities have not established that the incidents were connected, and responsibility for the intrusions remains unconfirmed.
False nuclear and chemical warnings in Ukraine
The Ukrainian incident began late on Sunday evening when users of the official Air Alert application started receiving unusual emergency notifications.
Ukrainian media reported that the first false warnings appeared at approximately 10:47 p.m. local time.
The messages included alerts about radioactive contamination and chemical threats in Kyiv.
Other notifications warned of possible street fighting and claimed that Russia had launched its Oreshnik missile.
The messages appeared within an application that millions of Ukrainians rely on to receive warnings about incoming aerial attacks.
Ukraine's Air Force quickly issued a statement explaining that the application appeared to have been subjected to unauthorised interference.
Crucially, the military said there was no radiation emergency corresponding to the messages.
The false warnings were not evidence of an actual nuclear or chemical attack.
The Air Force urged residents to remain calm and follow information from verified official channels.
Developers confirm unauthorised interference
The team responsible for the Air Alert application subsequently confirmed that unauthorised individuals had interfered with its operation.
The developers temporarily disabled push notifications and suspended parts of the application while investigating the incident.
Ukraine's Ministry for Digital Transformation advised residents to use alternative emergency-warning channels.
The ministry said official government notifications, local authorities and other warning services remained available.
The State Emergency Service also confirmed that the country's wider public-warning infrastructure continued operating.
This distinction is important because the compromise of a mobile application did not establish that every emergency siren or public-warning system had been disabled.
Residents were advised to continue responding to genuine alerts from authorised sources.
Authorities also warned against opening suspicious links that might appear in unexpected notifications.
Application partially restored
By early Monday, November 2, the Air Alert development team reported that the application was gradually returning to service.
According to an update carried by Ukrainska Pravda at 2:18 a.m. Ukrainian time, some warning functions had been restored.
The application's map was again displaying yellow and red danger levels, while push notifications about alerts had resumed.
However, the display of individual airborne targets remained temporarily disabled.
The developers said they were implementing additional security measures intended to prevent similar incidents.
They also stated that the application did not store users' personal information and that they had identified no associated threat to personal data.
That statement concerns the application's reported data-handling arrangements. It is not an independent forensic assessment of every possible consequence of the intrusion.
Russia reports a separate cyberattack
Early Monday, Russia's Emergencies Ministry announced that its mobile application had also been compromised.
The ministry said attackers had gained the ability to distribute false public-warning messages.
Russia's state news agency TASS published the announcement at 12:45 a.m. UTC.
The ministry said technical teams were working to address the vulnerability and restore normal operations.
Additional reporting from Ukrainian media described messages falsely claiming that nuclear-armed drones had been launched towards Russian regions.
Those specific message contents were reported by media organisations and were not independently authenticated through the ministry's initial statement.
The ministry's confirmed position was that a cyberattack had occurred and false information had been distributed.
Russian officials subsequently said the intrusion had not disrupted the country's broader emergency-warning infrastructure.
No confirmed nuclear attack accompanied the false messages.
Were the two incidents connected?
The close timing of the cyberattacks has raised questions about whether they were coordinated or connected to the continuing war between Russia and Ukraine.
Ukraine's Centre for Strategic Communications publicly attributed the interference affecting its warning application to Russia.
That attribution remains an allegation rather than an independently established forensic finding.
Russia has not publicly identified the perpetrators of the attack on its Emergencies Ministry application.
No verified evidence reviewed for this report establishes that the same individuals or organisation were responsible for both incidents.
The technical methods used to gain access to either application have also not been publicly established.
Investigators would need to examine system logs, access records and other technical evidence before making reliable conclusions about responsibility.
Public safety implications
Emergency-warning systems are especially important in Ukraine, where civilians frequently receive alerts about missile and drone attacks.
Many residents depend on mobile notifications to determine when to seek shelter.
False alerts can create confusion and unnecessary fear, while repeated misinformation could undermine confidence in legitimate warnings.
A compromised application can also become a potential route for phishing attempts or other forms of deception.
The incidents demonstrate how digital infrastructure used for civilian protection can become a target during conflict.
They also highlight the importance of maintaining independent warning channels so that the failure of one system does not prevent the public from receiving accurate information.
The Ukrainian authorities' confirmation that other warning services remained operational was therefore a significant part of their response.
Cybersecurity and the wider war
The incidents occurred as Russia and Ukraine continued military operations following the expiry of a temporary local ceasefire in the Kherson region.
Both countries have experienced cyberattacks and information operations during the conflict.
However, the timing of these particular incidents does not establish a direct connection to the ceasefire's expiry or to any specific military operation.
The cyberattacks should be assessed on the evidence currently available rather than assumptions about retaliation.
The immediate confirmed facts concern unauthorised interference with public-warning applications and the distribution of false information.
What happens next
Technical teams in both countries are working to restore and secure their affected applications.
Ukraine has reported partial restoration of its Air Alert service, while Russian authorities have acknowledged continuing remediation work.
Further investigations may clarify how the applications were compromised and whether the incidents were connected.
For civilians, the most important guidance remains to rely on verified official warning systems, avoid suspicious links and continue taking genuine emergency alerts seriously.
The incidents have exposed a serious vulnerability in digital public-safety communications during wartime.
Although no corresponding nuclear or radiation emergency was confirmed, the distribution of false warnings through trusted applications demonstrates how cyberattacks can directly affect civilian confidence and emergency preparedness.
