Ukraine's Air Alert app hit by cyberattack with fake nuclear warnings; Russia reports its own

On Sunday night, starting around 10:45 p.m. Kyiv time (3:45 p.m. ET), Ukrainians received a wave of false warnings through the country's emergency alert application, Air Alert. The messages told residents not to go outside because of radiation hazard, chemical threat and street fights. Another message, written in Russian, said all of Ukraine was under nuclear alert. "Don't worry," it added, "Oreshnik is in action," a reference to Russia's nuclear-capable hypersonic missile. That message pointed to a Telegram channel called Hitcorecorp. The major pro-Kremlin Telegram channel Mash said it spoke with the group and that the group took responsibility for the hack. NBC News could not verify who the group is or whether it was responsible.

Ukraine's air force said soon after that the Air Alert app had most likely been "compromised by the enemy", confirmed there was no "radiation threat" and urged calm. The app's creators said "unauthorized third parties interfered with the operation of the app", which forced them to temporarily suspend it. They later called the incident a "cyberattack" and said they were gradually restoring the service. One statement added: "The team is carrying out additional measures to protect the app in order to prevent similar situations in the future." Ukrainian media reported that users across the country got the alert, and authorities in the western Lviv region said some public warning sirens and loudspeaker systems broadcast a "radiation hazard" signal. On Monday the State Emergency Service of Ukraine said the national alert system was operating normally, and an NBC News producer in Kyiv saw no further problems with the app.

Reactions were mixed. Olena Yermakova, 32, a researcher in Kyiv, was outside with her dog when the first alert came. She ran inside and checked the news. Because the message was in Russian, she thought it was a hack by the Russians, but she described the seconds before that as "absolutely terrifying": she ran through a nuclear-threat checklist in her head and her hands started shaking. Many other Ukrainians did not appear unduly alarmed. Many shared memes mocking what they saw as a blatant fake, partly because it was in Russian. One X user wrote: "No one was particularly surprised. They might as well have thrown in a dinosaur attack, too."

Early Monday, Russia's emergencies ministry said its mobile application suffered a "massive cyberattack" that led to "dissemination of fake information to the public". It said the public alert system was restored and operating normally shortly after, and stressed that the app was only "an additional, supplementary information service". Screenshots shared by Russian media and some regional authorities suggested the alert, in Russian, warned of "nuclear warheads" launched at Russia. As with the Ukrainian alert, the wording was casual and did not appear official. Russian authorities did not say who was to blame, only that "malicious actors" were behind it. It was not immediately clear whether the two incidents were linked.

The incidents came just hours after a temporary ceasefire in the occupied southern Ukrainian region of Kherson ended. The truce, brokered with involvement from first lady Melania Trump and Pope Leo XIV, held without violations from either side for six days. It allowed the evacuation of hundreds of residents from the front-line town of Oleshky, which had been on the brink of a humanitarian catastrophe, and NBC News describes it as the biggest de-escalation between Kyiv and Moscow since the war began in early 2022. Before it took hold, the United Nations estimated that 2,000 civilians remained in Oleshky, many hungry and unable to leave safely because of heavily mined roads. Neither side has disclosed the exact number evacuated; Melania Trump said on Sunday it was nearly 800. Evacuees could go to territory controlled by either Ukraine or Russia, or stay in the town, officials on both sides said.

After the truce, the tone stayed guarded. Melania Trump posted on X that she commended Russia and Ukraine for their leadership and cooperation on the Oleshky ceasefire. Ukraine's human rights ombudsman Dmytro Lubinets said he was exploring "further humanitarian initiatives" with his Russian counterpart Yana Lantratova. Lantratova, the Russian human rights commissioner, said she had expected more people to leave, that "quite a few empty buses" departed, and that aid deliveries for those who stayed would happen at least monthly with Melania Trump's "coordination and mediation". Ukraine's armed forces accused Russia on Monday of using the truce to rotate units and fortify positions, while Kremlin spokesman Dmitry Peskov said Kyiv could also have used it to regroup, calling that "completely common practice in such situations".

Key facts

From about 10:45 p.m. Kyiv time on Sunday, the Air Alert app pushed false warnings of radiation hazard, chemical threat, street fights and a Russian-language nuclear alert; Ukraine's air force said the app had most likely been "compromised by the enemy".
A message referenced a Telegram channel called Hitcorecorp; the pro-Kremlin channel Mash said the group claimed the hack, but NBC News could not verify who the group is or whether it was responsible.
Early Monday, Russia's emergencies ministry said its own mobile app suffered a "massive cyberattack" that spread fake information, blaming only "malicious actors"; it is not clear whether the two incidents are linked.
Ukraine's State Emergency Service said the national alert system was operating normally on Monday, and the Air Alert creators said they were restoring service and adding protective measures.
The incidents followed the end of a six-day Kherson-region ceasefire around Oleshky, during which nearly 800 people were evacuated according to Melania Trump (neither side disclosed an exact figure).

Why it matters

Millions of Ukrainians rely on the Air Alert app to seek shelter before missile and drone attacks, so a false nuclear or radiation warning hits a system people act on without hesitation. The incident also landed just as the biggest de-escalation between Kyiv and Moscow since early 2022, the six-day Oleshky truce, ended, and NBC News notes the dueling accusations raise fears of intensified fighting rather than a move toward broader peace.

Who it affects

Ukrainian users of the Air Alert app, who received the false messages across the country, and residents of the Lviv region, where some sirens and loudspeakers broadcast a "radiation hazard" signal. On the Russian side it touches users of the emergencies ministry's mobile app, which received a fake nuclear-warhead warning. The app's creators and both governments' emergency services must now answer for the security of their alert channels.

How to use it

This is a news event rather than a product. For readers, the practical details are those the authorities gave: Ukraine's air force urged calm and said there was no radiation threat, the State Emergency Service said the national alert system was operating normally on Monday, and the Air Alert creators said service was being gradually restored with extra protection measures. Russia's ministry said its public alert system was restored and described its app as only a supplementary information service.

How solid is it

The facts of the false alerts rest on statements from Ukrainian authorities, the app's creators, Ukrainian media and screenshots of the Russian alert, and an NBC News producer in Kyiv saw no further problems with the app on Monday. The culprit is unconfirmed: Hitcorecorp's responsibility is only relayed by the pro-Kremlin channel Mash, and NBC News could not verify who the group is. Russian authorities named no one beyond "malicious actors". The source does not say how either app was compromised.

Risks and caveats

It is not established that the Ukrainian and Russian incidents are linked, and the source does not tie the hacks to the end of the ceasefire. The Ukrainian air force's "most likely compromised by the enemy" is a hedged assessment, not a proven attribution. Reactions varied from real fear, as in Olena Yermakova's account, to mockery of an obvious fake, which shows a plain-looking fake can still frighten people even when many see through it.

“I thought it was a hack by the Russians”

— Olena Yermakova, 32, a researcher in Kyiv, on the Russian-language alert