Ukraine's air raid alert app sends false nuclear and chemical warnings — Air Force says it was hacked
Ukraine's public air raid alert app briefly sent false warnings late on Sunday 1 November 2026 — for a short time it showed Kyiv and other areas subject to nuclear and chemical alerts and the threat of street fighting, and an erroneous message said Russia's hypersonic Oreshnik missile had been deployed, Reuters reported. Ukraine's Air Force said on Telegram the app 'appears to have been subjected to enemy influence' and stated: 'There is no radiation threat! Stay calm and follow our updates on our channel!' The abnormality later disappeared. Ukraine's Ministry of Digital Transformation said the app was not in operation, but other means of alerting the public were functioning, as were air raid sirens. Early on Monday 2 November, Russia's Emergencies Ministry said its own emergency-warning app had also been hit — a 'massive cyberattack' that spread false information — while Russia's wider warning system stayed normal; Moscow named no culprit, and whether the two incidents are connected is not established.
Checking in progress
This story is still being checked. Claims below are published as claims — never dressed as facts — and each one moves only when the evidence earns it.
- Collecting reportsDone
- Grouping the versionsDone
- 3Checking claims7 of 11 claims checked
- 4Human gateStill to come
7 of 11 claims checked so far · step 3 of 4: Checking claims
Key points
- False alerts: nuclear, chemical and street-fighting warnings for Kyiv and other areas, plus an erroneous Oreshnik missile message — shown briefly late Sunday, then gone (Reuters; BBC and Arab News agree).
- Air Force: the app 'appears to have been subjected to enemy influence'; 'There is no radiation threat! Stay calm.'
- Attribution not settled: no independent technical finding had been read at publish time — the hack cause is labelled not yet verified.
- Other alerts kept working: the Digital Transformation Ministry said sirens and other public alerting means were functioning.
Watch: the moment itself
Direct video sits at the top of Vozia's evidence ladder — the moment itself, from its owner. Embedded from its home platform; we never download or re-host it.
Video: FRANCE 24 English · Watch on YouTube
What happened
In a country under regular missile and drone attack, the air raid alert app is not a convenience — it is part of how millions decide whether to shelter. A false nuclear or chemical warning inside that trusted channel is therefore itself a harm, whether it was caused by an enemy operation, as the Air Force suggests, or by another failure not yet established.
The incident was reported three times in Vozia's queue in one evening (#809 Arab News, #813 BBC, #818 Arab News duplicate) — clustered here as one event, which is why it was worked before fresher single-mention items of similar size.
Claim by claim
Why this label: The false-alert content and its disappearance are reported by Reuters (read directly in full in this pass via its syndication), and the BBC and Arab News report the same event (queue #809, #813, #818 — the same incident reported three times, clustered here, not three incidents). What users were shown is established; who caused it is a separate claim, below.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Verified as the Air Force's own statement: its Telegram words are quoted verbatim by Reuters, read directly, and reported the same way by the BBC and Arab News. The 'no radiation threat' line is the Air Force's assurance, carried as its statement.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Updated after the BBC/AFP full reads: asked by AFP whether the app had been hacked, Air Force spokesman Yuriy Ignat said, 'Yes, it has been,' and Vinnytsia's governor Natalya Zabolotna called it a cyberattack and warned people not to click a link in the message; Ukraine's SPRAVDI centre blamed Russia. Those are still statements by Ukrainian officials and bodies — the Air Force is confirming its own claim, and no independent technical or forensic finding had been read for this page — so the cause stays labelled not yet verified, and Russia's blame is carried as SPRAVDI's position, not as a finding.
On the ladder: the evidence so far sits low — early, single or social sources. We publish the claim as a claim, never as fact.
Show all claims (8 more)
Why this label: The ministry's position is reported by Reuters in the same report read directly in this pass. It sits alongside the Air Force statement: the app channel failed / was interfered with, while sirens and other alerting means kept working, on the ministry's word.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The timed, language-by-language sequence is the BBC's full report, read after first publish. It matches the Reuters account of the same alerts and adds the exact sequence and the all-clears.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Verified as the Russian ministry's own statement, made on Telegram early on Monday and reported by TASS, and carried consistently by Al Jazeera (read in full via live-browser recovery), DW and France 24. This verifies what Moscow says happened to its app — it does not verify who carried out either incident. Al Jazeera gives no detail of what the false information on the Russian app said.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: No report read for this page establishes a connection: Ukraine's SPRAVDI blamed Russia for the Ukrainian incident, Moscow named no one for its own, and two incidents hours apart do not by themselves prove a link. The connection stays Not yet verified.
On the ladder: the evidence so far sits low — early, single or social sources. We publish the claim as a claim, never as fact.
Why this label: From the Associated Press's full Monday report, read in full in this run: the restoration is the Ukrainian authorities' account, the language detail is AP's description of the alerts themselves, and Ihnat's no-impact statement was given to Ukraine's 1+1 television. AP also reports the Centre for Countering Disinformation urged users to follow emergency channels on social media and physical alerts while the attack was addressed.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: AP reports that one false post mentioned Hitcore and that Mash, a Russian Telegram channel with links to the security services, said it had spoken to Hitcore representatives who claimed responsibility — and that the claim could not be independently verified. It stays Not yet verified.
On the ladder: the evidence so far sits low — early, single or social sources. We publish the claim as a claim, never as fact.
Why this label: The BBC's own on-the-ground report (Dan Johnson, Kyiv; read in full in this pass), including its named residents' accounts and the 15-minute / over-an-hour timings. The residents' words are carried as their accounts; the timings are the BBC's reporting.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: An expert's assessment, not a forensic finding: Baliutov's attribution and his retaliation reading are his analysis, the BBC itself frames the perpetrators as likely hacktivists, and no developer or official forensic report had been read. This does not change the label on the hack-attribution claim above; who carried out either incident stays in the don't-know list.
On the ladder: the evidence so far sits low — early, single or social sources. We publish the claim as a claim, never as fact.
What we know / what we don't know yet
What we know
- That false nuclear, chemical and street-fighting alerts, and a false Oreshnik message, were briefly shown and then disappeared — Reuters, BBC and Arab News agree.
- The Air Force's exact words and its no-radiation-threat assurance, and the ministry's statement that sirens and other alerting means were functioning.
- The false messages ran 22:47–22:49 local time and were followed by all-clears (BBC); a separate Kyiv-specific alert app was not affected and remained operational (Kyiv authorities via AFP/Arab News).
Show more (1)
- Russia's Emergencies Ministry says its own warning app was hit by a 'massive cyberattack' early on Monday 2 November that spread false information, while Russia's wider warning system stayed normal — the ministry's own statement via TASS, reported by Al Jazeera, DW and France 24.
What we don't know yet
- Who or what actually caused the false alerts — the Air Force's 'enemy influence' wording is a suggestion, not a published technical finding, and no developer forensic report had been read.
- How many users received the false warnings, and for exactly how long they were displayed — reports say only 'for a short time'.
- Whether the attack on Russia's Emergencies Ministry app early on Monday was connected to the Ukrainian incident hours earlier, and who carried out either — Moscow has named no one, and no forensic finding for either incident had been read.
Why it matters
Warning systems only work if people trust them. If an adversary can put a false nuclear alert inside Ukraine's official warning channel — a claim not yet independently proven — the damage is measured in panic tonight and in hesitation the next time a real alert sounds.
Update history
No silent edits. Every change is written here, with its time.
- Latest
Checking in progress — the BBC's full Monday report from Kyiv is added (queue #1023): unease but not panic among residents (named accounts from Lviv and Kyiv), the Air Force's no-radiation-threat statement within 15 minutes and all-clears more than an hour later, and the Telegram-link phishing risk — carried as verified reporting. A Kyiv cybersecurity expert's attribution and retaliation assessment is added as its own Not yet verified claim; it is expert opinion, not a forensic finding, and no attribution label on this page changes. The story's existing official video (France 24 English) already covers this incident, so no new video was attached.
Checking in progress — AP's full Monday report adds the restoration and the unverified Hitcore claim: Ukrainian authorities say the app was restored overnight; the false alerts ran in English with spelling and grammatical errors and in a mix of Russian and Ukrainian; Air Force spokesman Yurii Ihnat said the attack had no impact on defence operations because the app is separate from military command systems. One false post mentioned the group Hitcore, which the Russian Telegram channel Mash said claimed responsibility — AP says that claim could not be independently verified, and it is labelled Not yet verified here. France 24's official video report of the incident is now attached (YouTube oEmbed check passed in this run). This story stays in Checking.
Checking in progress — the incident is now two-sided: early on Monday 2 November Russia's Emergencies Ministry said its own warning app was hit by a 'massive cyberattack' spreading false information (via TASS; Al Jazeera read in full, DW and France 24 in agreement), while its wider warning system stayed normal. Moscow named no culprit. Whether the two app incidents are connected is added to what we don't know, labelled Not yet verified. The Ukrainian alerts in the new reports are the same Sunday-evening incident already on this page, not a second event. No official video was attached — no embeddable official video about these developments was verified via YouTube's oEmbed endpoint in this run.
Show earlier updates (2)
Update from the BBC and AFP full reports, read after first publish: the false messages ran 22:47–22:49 local time (radiation, nuclear/Oreshnik, chemical, street-fighting, then all-clears); Air Force spokesman Yuriy Ignat told AFP, 'Yes, it has been' hacked, Vinnytsia's governor called it a cyberattack and warned against clicking a link in the message, and SPRAVDI blamed Russia — all carried as those officials' statements; the attribution claim stays not yet verified because no independent forensic finding has been read. The separate Kyiv-specific app was not affected.
Story published in Checking state (queue #809/#813/#818 clustered as one event). Basis: Reuters read directly in full, cross-checked against BBC and Arab News. False alerts verified; hack attribution labelled not yet verified.