Ukraine's air raid alert app had a rough Sunday. According to the Ukrainian Air Force, the app was apparently hacked and, for a short time, informed users that the capital, Kyiv, was under a radiation threat. The alert on Telegram read: "The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel." Nothing says "stay calm" like a push notification suggesting you might glow in the dark.
The Ukrainian Central Intelligence Agency said there had been a failure in the app and urged people to use other sources to clarify the situation on the threat of air strikes. A few hours later, Russian authorities said their app was hacked too. A Ukrainian espionage group claimed fake warnings of nuclear strikes inside Russia had been sent to users. Because nothing says "mutual respect" like a good old-fashioned cyber tit-for-tat.
Russia has the world's biggest nuclear arsenal, and President Vladimir Putin has repeatedly suggested an openness to using all weapons at Russia's disposal. So, you know, the fake alert wasn't entirely outside the realm of possibility.
The alerts, in Ukrainian, started at approximately 22:47 (20:47 GMT), with red-level air raids apparently issued nationwide. Additional warnings were issued in Kyiv, with the first reading: "Radiation threat. Radiation threat declared in Kyiv." The next message, written in Russian, came at 22:48: "Hi! There will be a nuclear alert across Ukraine. Don't worry, it's Oreshnik flying." Because nothing says "don't worry" like a nuclear-capable missile name-drop.
A third alert, at 22:49, again in Ukrainian, said: "Chemical threat. There is a threat of a chemical attack on Kyiv. Don't go outside." At 22:49, a fourth alert stated there was a "Street fighting threat. Street fighting is taking place in Kyiv. Don't go outside." At 23:53, a series of all-clear messages were delivered to users' phones, individually declaring each threat clear. So, for about an hour, Kyiv was apparently under simultaneous radiation, chemical, and street-fighting threats - a trifecta of doom that would make even the most hardened doomsday prepper blush.
In a separate post on Telegram, the Ukrainian Central Intelligence Agency said that due to the Air Alert application, the Radiation Hazard signal was played on loudspeaker devices in the Lviv region, and added there was no threat of radiation hazard. If the alert app is not working, Ukraine's Centre for Countering Disinformation advises the public to turn on notifications on their smartphones, pay attention to sirens, and to only read official sources. In other words, maybe don't trust the app that just told you to panic.
Several leaders of other regions also posted on Telegram that the app had apparently been hacked and there was no local threat. "Everything is calm in the region for now," said Svitlana Onyshchuk, the governor of the Ivano-Frankivsk Oblast. The app had reported a red-level air raid alert for the oblast in Ukraine's east, between 22:50 and 23:57. The Vinnytsia regional head, Natalya Zabolotna, said there had been a cyber-attack on the Air Alert app and posted a warning on Telegram not to click on the link in the message, which could be a phishing attempt. Because of course the hackers would also try to phish you while they're at it.
The Air Alert app is supported by the Ministry of Digital Transformation of Ukraine and informs users instantly about the beginning and end of defence alerts. The ministry had earlier said the app was temporarily disabled for maintenance after it had "apparently been compromised." It urged residents to turn on their smartphones' emergency notifications so they could receive state-issued distress signals. Nothing like a little downtime to remind you of the good old days of air raid sirens.
A few hours after the false alerts in Ukraine, Russia's ministry of emergency situations said its app had been subjected to "a massive cyberattack" which sent "fake information to the public." No further details were given by the ministry or state media. Ukrainian news outlet UNN reported the hack sent fake alerts of a nuclear threat inside Russia. Atesh, a partisan Ukrainian group operating inside Russian-held territory, said on its Telegram page that the app had been hacked, accompanied with laughing emojis. A screenshot of a purported emergency alert published by Atesh, which has not been verified by the BBC, told users to "urgently" stock up on provisions for three weeks and take cover in basements. It also used obscene language. Atesh has been contacted for comment. Because if you're going to hack an emergency app, you might as well throw in some profanity.
The alerts occurred just minutes before the end of a localised ceasefire in Ukraine's front-line Kherson region, which was implemented last Tuesday and officially ended at 23:00 Sunday. Fighting had continued elsewhere while the Kherson ceasefire was in place, to allow civilians to evacuate the Russian-occupied city of Oleshky. Russia launched a full-scale invasion of Ukraine in February 2022. So, in summary: the app got hacked, everyone panicked, and then everyone un-panicked. Just another Sunday in the brave new world of cyber warfare.