Millions of people in Ukraine and Russia received fake warnings of nuclear and chemical attacks on their phones late on Sunday, November 1, 2026, and into the early hours of Monday, November 2, after hackers breached the official emergency alert apps used in both countries. There was no nuclear attack, no confirmed radiation threat, and no chemical attack behind the messages. Officials in both countries said the alerts were false, issued clarifications, temporarily disabled push notifications on the affected apps, and later restored them. What remains unresolved, and what readers should not treat as settled, is who carried out either breach, whether the two incidents were connected, and whether they were coordinated retaliation or separate acts by different groups exploiting a moment of heightened tension.
The Ukrainian incident came first. Just before 11 p.m. local time on Sunday, which is 9 p.m. Greenwich Mean Time, users of Ukraine’s widely used Air Alert app, known in Ukrainian as Povitriana Tryvoha, began receiving false alerts. Some alerts warned of radiation and chemical threats, others warned of street combat in Kyiv, and one warned that Russia had launched a hypersonic Oreshnik missile, a weapon capable of carrying a nuclear warhead, and that a nuclear alert had been declared. In roughly seven minutes, 122 fake alerts were issued through the app, in Russian, English and Ukrainian, according to detailed reporting of the incident. One Russian-language message said there would be a nuclear threat across Ukraine and told readers not to worry because the Oreshnik was incoming. The messages were designed, in the words of one report, to sow panic, and they arrived on phones belonging to people who rely on the app for real warnings about Russian missile and drone strikes.
Ukraine’s Air Force responded on Telegram shortly afterwards, saying the app appeared to have been subjected to enemy influence and telling the public plainly that there was no radiation threat, to stay calm, and to follow updates on its official channel. All-clear messages were sent shortly after each false alert, and Ukraine’s Ministry for Digital Transformation said the app had been temporarily suspended, while air raid sirens and other public alert channels continued to function. The Ukrainian government also said a separate app created for Kyiv was working normally. That distinction mattered in practice: even while the national app was taken offline for maintenance, people were not left without any warning system, although the temporary loss of a familiar app still carried risk, because a real attack during that window would have had to be communicated through other channels.
Ukraine’s Center for Strategic Communications, known as SPRAVDI, blamed Russia in a post on X, pointing to the use of the Russian language in one of the fake messages and to the appearance of several unusual alerts. That blame is an allegation by a Ukrainian government communications body, not an independently verified finding, and it should be read as such. The Ukrainian Air Force itself used more cautious language, saying the app appeared to have been subjected to enemy influence, without presenting forensic evidence in its public message. The use of Russian in a fake message is a clue that investigators may examine, but it is not proof of who typed the message: hackers routinely write in languages other than their own, copy official phrasing, or deliberately plant misleading clues. Readers should therefore separate two different facts: that Ukrainian officials said the app was hacked and that its messages were false, which is well supported, and that a particular state or group was responsible, which has not been independently established.
Ukraine Air Alert app hack: 122 fake alerts in about seven minutes
The scale and speed of the Ukrainian breach are part of why it attracted so much attention. One hundred and twenty-two alerts in about seven minutes is not the pattern of a single mistaken message or a single operator error. It suggests automated or bulk injection of messages into the app’s notification system, although the exact technical method has not been publicly confirmed in the reporting reviewed for this article. The alerts were also inconsistent in a way that, for many users, gave the game away quickly. Official Ukrainian alerts are issued in Ukrainian, which is compulsory for official communications, so messages in Russian stood out. English-language versions contained spelling and grammatical errors that also signalled fakery. Reporting from Kyiv said many people understood within about half an hour that the messages were the result of a hacking attack, and that speakers in the centre of the city had also broadcast warnings, which added to the initial confusion before the clarification spread.
About three hours later, a second breach was reported in Russia. At around 2:45 a.m. Moscow time on Monday, fake alerts appeared on the app of Russia’s Ministry of Civil Defence, Emergencies and Disaster Relief, commonly called the Emergencies Ministry. The ministry said its app had come under a massive cyberattack that transmitted false information to the public. The fake messages warned that nuclear warheads mounted on Ukrainian P1-SUN drones had been launched against all regions of Russia, told people to stock up on food for three weeks, and urged them to hide in basements. The messages, some of which contained profanity and derogatory language about Russia, reached 33 of Russia’s 89 regions, according to the ministry and to reporting that cited its statements. The ministry said its specialists were working to restore the app, that full functionality would be restored by the end of the day, and that the public should trust only official sources, including the ministry’s website and official social media accounts.
Russia Emergencies Ministry app hacked across 33 of 89 regions
The Russian ministry also sought to limit the significance of the breach, saying the app was not one of its main public warning channels but a supplementary source of information. It said the hack had not affected, and could not affect, the main warning network of sirens, loudspeakers, text messages and broadcasts. That claim, like the Ukrainian claim about sirens continuing to work, is important to verify in context: if the main warning network was indeed untouched, then the practical risk of the Russian breach was mainly confusion and anxiety, rather than the loss of the ability to warn the public about a real emergency. If, on the other hand, users treat the app as their primary source, the distinction between a main channel and a supplementary channel may matter less to them than it does to the ministry. The reporting reviewed does not independently confirm the ministry’s technical claim about the separation of systems, so it is presented here as the ministry’s position, not as an established fact.
The content of the Russian fake messages also did not hold up under scrutiny, for a specific technical reason. The P1-SUN system named in the messages does exist, but it is a Ukrainian interceptor drone, made by the defence firm SkyFall and designed to shoot down Russian attack drones, not a long-range nuclear delivery vehicle. Reports noted that its warhead is small, about 1.75 pounds, and its range is just over 20 miles, far too little to strike deep into Russia, let alone to carry nuclear warheads to all regions of the country at once. That implausibility is one reason analysts cited for doubting that the messages were an official warning, even before the ministry’s clarification. It also illustrates a pattern in both breaches: the fake messages borrowed the vocabulary of real weapons and real warning systems, but combined them in ways that did not make operational sense.
Claims about who carried out the Russian breach are, like the claims about the Ukrainian breach, unverified. Atesh, a pro-Ukrainian hacking group, posted a screenshot of the Russian alert on Telegram early on Monday, saying the Ministry of Emergency Situations app had been hacked. That post is evidence that a pro-Ukrainian group publicised the breach, but it is not, by itself, proof that Atesh carried it out. Separately, a group identifying itself as DC8044, described as an independent Kyiv-based cybersecurity community, was reported to have said it carried out the Russian breach through the app’s programming interface. That claim, too, has not been independently verified. On the Ukrainian side, a Russian Telegram channel linked to the country’s security services was reported to have said a hacking group called Hitcore had claimed responsibility for breaching Ukraine’s system. That claim has also not been independently verified. Reuters, whose reporting underpins much of the coverage of this incident, said it was unable to verify which groups were responsible.
Attribution not verified and the question of a coordinated attack
The honest summary, therefore, is that attribution is not established. Ukraine’s strategic communications body blamed Russia. A pro-Ukrainian group publicised the Russian breach. A Russian-linked channel attributed the Ukrainian breach to a named group. A Kyiv-based community was reported to have claimed the Russian breach. None of those statements, taken alone or together, amounts to independent verification, and experts quoted in coverage have noted that previous cybersecurity incidents in the war have been linked both to activist hackers and to intelligence agencies on both sides. The possibility that the two breaches were retaliatory, with the second carried out in response to the first, was reported by the BBC’s cyber correspondent, quoting a source in the Ukrainian hacktivist community. That is a reported possibility, not a confirmed sequence of events, and it should not be presented as fact.
It is also far from obvious, as one detailed report put it, that the same groups or people organised both tricks, despite the similarity of the false alerts and the short interval between them. Hacktivist groups on both sides have, in the past, held back from targeting emergency alert systems for what one hacktivist described as moral and ethical reasons, according to that reporting. If that restraint has now been abandoned, it would mark a change in norms, with implications beyond this one night. But a change in norms cannot be inferred from a single night’s claims, especially when the claims themselves are contested. What can be said with confidence is that two official alert apps were breached within hours, that both breaches used nuclear framing, and that both governments treated the incidents as serious enough to issue public clarifications and to suspend or repair the affected apps.
The timing of the breaches adds context, but it does not prove motive. The fake warnings in Ukraine began minutes before the end of a six-day local ceasefire in the Russian-occupied Kherson region, in the southern Ukrainian town of Oleshky, also spelled Olekshy in some reporting. That ceasefire, which the United States said was brokered by First Lady Melania Trump, allowed humanitarian aid and evacuations in the area and was described as the longest such pause in fighting since Russia’s full-scale invasion in 2022. Its expiry meant a return to fighting in that area was expected, and reporting from Kyiv noted that many people there now expected renewed fighting along the front lines. Whether the hackers timed their messages to coincide with the ceasefire’s end, or whether the coincidence is incidental, has not been established. The timing is therefore noted here as context, not as evidence of intent.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from Dawn, Cybernews and Al Jazeera.