Emergency warning applications in Ukraine and Russia were compromised in separate cyberattacks on November 1 and 2, 2026, allowing hackers to distribute fabricated alerts about nuclear strikes, chemical hazards, and other threats. Both governments confirmed unauthorized interference with their mobile services, although the identities of those responsible remain unverified.
The first incident affected Ukraine’s Povitriana Tryvoha (Air Alert) application, which millions of residents use to receive warnings about incoming missiles, drones, and other emergencies. Shortly before 11 p.m. on November 1, users began receiving alarming notifications claiming that Kyiv faced radiation exposure, chemical attacks, and street fighting.
According to reports, the attackers distributed 122 false notifications within approximately seven minutes. The messages appeared in Ukrainian, Russian, and English, with some falsely claiming that Russia had launched an Oreshnik ballistic missile carrying a nuclear threat.
Ukraine’s Air Force quickly warned that the application had been compromised and confirmed there was no reported radiation emergency. The developers temporarily suspended the service and disabled push notifications while investigating the unauthorized activity.
The disruption did not affect Ukraine’s broader emergency warning infrastructure. Air raid sirens and alternative official notification channels remained operational, while the application’s developers began gradually restoring its functions on November 2.
Several hours after the Ukrainian incident, Russia’s Ministry of Emergency Situations reported a similar intrusion affecting its own mobile application. False notifications appeared in 33 Russian regions, claiming that nuclear warheads had been launched and instructing residents to stockpile food and seek shelter.
Russian officials said attackers had exploited a vulnerability in the application’s administrative interface. Technical teams isolated the affected services and worked to restore normal operations. The ministry emphasized that its main public warning infrastructure, including sirens, television, radio, and text messages, remained unaffected.
Two hacking groups have reportedly claimed responsibility for the incidents. A previously unknown group calling itself Hitcore Corp was linked to the Ukrainian alerts, while a pro-Ukrainian group known as DC8044 claimed it had compromised Russia’s emergency application through an API. Neither claim has been independently verified.
Although the attacks occurred only hours apart and involved similar false nuclear warnings, investigators have not established whether they were coordinated or carried out by unrelated groups.
Both affected applications subsequently resumed sending notifications, with Ukrainian developers implementing additional security measures as they continued restoring the service.