Fake nuclear attack alerts hit millions of Ukrainians and Russians on the same day
Official alert apps in Ukraine and Russia sent out false nuclear-threat warnings to millions of users on Sunday, as both sides said their systems were compromised.
Ukraine’s air raid alert app is used by 6.7 million people, according to its digital transformation ministry and the app’s developer, Ajax Systems.
Ukraine was hit first by the fake alerts, with its air raid warning app sending out messages in Ukrainian just before midnight of a “radiation threat in Kyiv.”
A follow-up message, written in Russian, said: “There will be a nuclear alert across Ukraine. Don’t worry, it’s Oreshnik flying.”
The Oreshnik is considered one of Russia’s most powerful intermediate-range ballistic missiles. It can travel at roughly 10 times the speed of sound and can disperse multiple warheads in clusters. Russia says it is also capable of carrying nuclear warheads.
Other false messages warned of chemical threats and “street fights” in Kyiv, according to screenshots seen by Business Insider.
The Ukrainian air force’s Telegram channel, which Ukrainians routinely rely on for air raid and drone threat alerts, said later said there was “no radiation threat” and that its app had likely been compromised.
SPRAVDI, Ukraine’s center for strategic communications, blamed Russia for the fake messages.
“If you see strange messages in the app, disregard,” it said in a post on X.
Hours later, Russia’s emergency ministry said its mobile app had also been “subjected to a massive cyberattack” that sent out false information to the public.
Regional air raid alert Telegram channels run by the ministry issued nonsensical warnings in Russian filled with vulgarities, according to screenshots seen by Business Insider.
One message said “P1-Sun carriers,” referring to a small Ukrainian interceptor quadcopter, were sending nuclear warheads to Russia. Another message urged Russians to stockpile three weeks’ worth of food at home.
Russia has not officially accused anyone of the cyberattack yet.
Both Ukraine and Russia have waged cyberattack campaigns against each other as the war rages, disrupting public alert services or causing them to send false warnings. Kyiv has also accused Russia of launching cyberattacks on critical civilian and energy infrastructure.
A similar incident in Russia occurred in February 2023, when multiple radio stations began suddenly broadcasting fake air raid and missile alerts at a time when Ukrainian attacks on Moscow were extremely rare.
A week after the first attack, hackers breached multiple Russian private radio and TV stations to send out audio alerts and display visual tickers warning of false attacks.