Ukraine and Russia investigate hacked emergency alert apps

Emergency alert apps in Ukraine and Russia sent false warnings of nuclear and other attacks hours apart on Sunday night, prompting authorities in both countries to warn residents that the messages were fake. It was unclear who carried out the hacks or whether they were connected.

In Ukraine, the widely used Air Alert app issued red-level air raid warnings across the country. Some users also received messages about radiation, chemical attacks and street fighting, including in Kyiv. CBS News reported that the false notifications began at 10:47 p.m. local time.

Ukraine’s air force moved to counter the warnings on its official channels. “The Air Alert app appears to have been subjected to hostile interference. There is no radiation threat!” it said in a Telegram message reported by CBS News. It urged people to stay calm and follow official updates.

The app’s developers said there had been “unauthorized interference” and temporarily disabled the app and its push notifications, according to CBS News. Air force spokesman Yurii Ihnat said the breach had not affected Ukraine’s security operations and that the app was not connected to military command systems.

Some Ukrainians spotted signs that the warnings were false: Several messages were written in Russian rather than Ukrainian. Olena, a Kyiv resident, told the BBC that her first thought on receiving a nuclear warning was, “Oh my god, I’m not prepared for this.” After her husband received an alert about street fighting and another in Russian, she said, she realized the app had been attacked.

A few hours later, Russia’s Emergencies Ministry app sent false warnings to users in 33 regions, according to Russian media cited by CBS News. The messages warned of nuclear warheads launched across Russia and told residents to stock up on food for three weeks and shelter in basements. The BBC reported that some of the messages contained profanities.

Russia’s Emergencies Ministry said attackers had exploited a vulnerability in the app’s administrative panel and that it had disconnected and isolated affected services, CBS News reported. The ministry said on Monday that the wider alert system had not been affected and that it expected to restore the app’s full functionality by the end of the day, according to the BBC.

The Ukrainian alerts came shortly before a temporary ceasefire expired Sunday night around Oleshky, a Russian-occupied city in southern Ukraine. The truce began Oct. 27 and allowed humanitarian aid into the city and some civilians to evacuate. Ukraine’s human rights commissioner, Dmytro Lubinets, said both sides had observed the agreement and were discussing further humanitarian measures, CBS News reported.

There was no indication that the false alerts caused widespread panic. Oleksander Merezhko, chair of the Ukrainian parliament’s foreign affairs committee, told the BBC the attack had not prompted extreme reactions. Many Ukrainians, he said, are accustomed to frequent alerts, while the Russian-language messages immediately raised suspicions.