Key Takeaways
- Ukraine's Air Alert app, which The Record says had 6.6 million active users as of January 2026, sent false warnings of a nuclear threat, radiation, chemical attacks, and street fighting late on November 1, 2026, before its developers suspended the service.
- Russia's Emergency Situations Ministry said attackers used its mobile app to send a fake alert to 33 of Russia's 89 regions at about 2:45 a.m. Moscow time on November 2, 2026.
- Ukrainian President Volodymyr Zelensky confirmed in a PBS News interview on November 2, 2026, that Ukraine hacked Russia's emergency alert app, saying Ukraine was responding to a Russian cyberattack on its own system.
- A previously unknown group called Hitcore Corp claimed the hack of Ukraine's Air Alert app, a claim that the Associated Press and NBC News could not verify, and a Kyiv-based group called DC8044 claimed the attack on the Russian app.
What happened in Ukraine
Late on November 1, 2026, users of Air Alert, an app Ukrainians rely on for warnings of incoming Russian missiles and drones, received false alerts about a radiation hazard, a chemical threat, a nuclear threat, and street fighting in Kyiv. The alerts began at 10:47 p.m. local time, CBS News reported.
One message, written in Russian, referred to Oreshnik, a Russian ballistic missile that can carry nuclear warheads, according to The Record and the Associated Press. Air raid sirens also sounded in streets across the country, the Kyiv Independent reported. NBC News reported that some public sirens and loudspeakers in the western Lviv region broadcast a "radiation hazard" signal.
Ukraine's air force said the app had likely been "compromised by the enemy" and that there was no radiation threat, according to The Record and CBS News. The developers said "unauthorized" people had interfered with the app, then disabled push notifications and suspended the service. By early November 2, they had begun restoring it.
The Ukrainian security company Ajax Systems developed Air Alert, which launched in 2022 with support from Ukraine's Ministry of Digital Transformation, The Record reported. The developers said the app does not store personal data.
The attack on Russia's alert app
Hours later, hackers sent a false alert through the mobile app of Russia's Ministry of Emergency Situations, also known as EMERCOM. The ministry said the alert reached 33 of Russia's 89 regions at about 2:45 a.m. Moscow time on November 2, the AP reported. The messages claimed that nuclear warheads had been launched across Russia and told residents to stock up on food for three weeks and shelter in basements, according to CBS News and the Kyiv Independent.
The ministry said attackers had exploited a weakness in the app's administrative panel, CBS News reported. It said the hack did not affect the country's public warning system, and that sirens, loudspeakers, text messages, television, and radio still carried alerts, according to The Record.
Who is behind the attacks
The fake Ukrainian alert linked to a Telegram channel of a previously unknown group called Hitcore Corp, which claimed responsibility, The Record reported. The AP and NBC News said they could not verify the claim. A group called DC8044, which describes itself as a hacking community based in Kyiv, claimed the attack on the Russian app, according to The Record.
Ukrainian President Volodymyr Zelensky confirmed the retaliation in an interview with PBS News on November 2. "They attacked our system," he said. "It was a cyberattack." Asked whether Ukraine had hacked Russia's app in response, he said, "Yeah, absolutely. We just responded to the attack," according to the Kyiv Post. The Kyiv Post reported that he said Ukrainian intelligence had identified the first intrusion as a Russian operation.
Russian authorities did not name who they believed carried out the attack on their app, the AP reported. Kremlin spokesperson Dmitry Peskov said Russian state agencies face a constant threat of cyberattacks and that "all government bodies must take steps to improve the cybersecurity of our digital resources."
The hacks came as a humanitarian ceasefire around the Russian-occupied city of Oleshky in southern Ukraine expired, according to the AP and CBS News.
What authorities told residents
Ukraine's State Emergency Service said the national alert system was working normally and urged people "not to click on links from unknown sources and not to spread unverified information," the Kyiv Independent reported. Ukraine's Center for Countering Disinformation told users to follow other emergency channels and rely on physical alerts while authorities dealt with the attack, according to the AP. The Ministry of Digital Transformation recommended that Kyiv residents use the separate Kyiv Digital app for air alerts.
Background
Fake warnings have gone out through alert systems before. In 2023, hackers reportedly interrupted several Russian commercial radio stations with fake warnings of air raids and missile strikes, The Record reported. The same year, the security company Group-IB reported that the hacktivist group AnonGhost had compromised Red Alert, an Israeli app that warns of incoming rockets, and sent some users a fake warning about a nuclear bomb, according to The Record.