Ukraine's air raid alert system hacked, Russian system targeted hours later

Editor's note: This story was updated to include a statement from Kremlin spokesperson Dmitry Peskov.

Ukraine's air raid alert system was hacked late Nov. 1, the Air Force said, as sirens sounded across the country and people received false alerts warning of nuclear, chemical, and street fighting threats.

Russia's air raid alert system was also hacked in the early hours of Nov. 2, the Russian Ministry of Civil Defense, Emergencies and Disaster Relief confirmed in a social media statement, in what may have been a Ukrainian response to the earlier Russian cyberattack.

Kremlin spokesperson Dmitry Peskov commented on the cyberattack targeting the ministry's mobile app, which led to fake notifications being sent to users, saying that Russian government agencies' electronic resources are under constant threat of cyberattacks.

"The website of the president of the Russian Federation is subjected to cyberattacks many times a day, every day. The same goes for other government agencies," he said during a press briefing on Nov. 2.

Kyiv Independent journalists on the ground received notifications on their phones from the officially supported Air Alert app, made in collaboration between the Digital Transformation Ministry and security technology company Ajax Systems.

"Today, unauthorized persons have interfered with the application. We have disabled push notifications and temporarily suspended the application," the developers of the app said in a statement.

During the hack, a variety of fake alerts and messages in Russian were sent to users' phones.

"Hi! A nuclear alert is about to go off all across Ukraine! Don't worry, the Oreshnik is on its way," one of the false warnings read in Russian on the Air Alert app.

Air raid alerts also sounded in streets across the country, including Zakarpattia Oblast in western Ukraine, journalists on the ground reported.

For Kyiv residents, the Digital Transformation Ministry recommended using the "Kyiv Digital" app to stay aware of air alerts.

Several regional governors also warned that the system was hacked and advised residents that there was no threat.

"Currently, the situation in the oblast is calm. Reports indicate a cyberattack on the notification app," Ivano-Frankivsk Oblast Governor Svitlana Onyshchuk said.

Officials also warned the cyberattack could involve a phishing operation with attached links.

"Cyberattack on the 'Air Alert' app. Do not click on the link in the message," Vinnytsia Oblast Governor Natalia Zabolotna reported.

The false alerts were then cleared about an hour later.

By midnight local time, Ukraine's State Emergency Service said that while the nationwide alert system was back to operating normally, citizens should continue to monitor information from local authorities and listen for signals played on loudspeakers.

"We once again urge citizens not to click on links from unknown sources and not to spread unverified information," the Emergency Service said.

At around 2 a.m. local time, the Air Alert app said that operations were gradually being restored while the display of targets was temporarily suspended.

"The team is implementing additional security measures to protect the app and prevent similar incidents in the future," said the app's official Telegram channel. "We would like to reiterate that the app does not store or use personal data, so there is no threat to users.”

In an apparent Ukrainian response to the Russian hack, the Russian air raid alert system was also hacked a few hours later on Nov. 2.

Messages were sent to users claiming "nuclear warheads" had been "launched across all regions of Russia," and that users should "stock up with food for three weeks" and hide in their basements.

The Russian government confirmed the apparent Ukrainian hack in statements on Telegram.

"Attention! The Russian Ministry of Emergency Situations' mobile app has been subjected to a massive cyberattack, allowing attackers to send fake information to the public," the Russian Ministry of Civil Defense, Emergencies and Disaster Relief said in a statement.

"Work is currently underway to patch the vulnerability and restore normal operation," they said.