Late on Sunday night, loudspeakers in the Lviv region played a radiation hazard signal, hundreds of kilometres from any front line. Nothing had happened. The signal came from the same place as the fake warnings lighting up phones across Ukraine: the Air Alert app, the state-backed warning service that Ukrainian officials say was compromised by Russia on November 1. That detail, reported by the BBC, is the part of this story that deserves more attention than the hack itself.
Fake alerts on a phone are frightening but easy to dismiss once officials speak up. A siren on the street is different. It is what people are trained to obey without checking. Sunday’s breach showed that a single phone app now sits upstream of physical warning hardware, and that it can wake people in silent mode, all at once.
Sixty-six minutes on Sunday night
We assembled the sequence below from the BBC’s minute-by-minute account and reporting by the Kyiv Independent, whose journalists received the Air Alert app notifications on their own phones. All times are Kyiv time.
- 22:47 – Red-level air raid alerts appear nationwide. In Kyiv, a message declares a radiation threat.
- 22:48 – A message in Russian arrives: “Hi! There will be a nuclear alert across Ukraine. Don’t worry, it’s Oreshnik flying,” a reference to Russia’s hypersonic missile.
- 22:49 – Two more Kyiv warnings follow, one for a chemical attack and one claiming street fighting in the capital. Both tell people not to go outside.
- 22:50 – Ivano-Frankivsk shows a red-level alert that stays up until 23:57.
- Soon after – The Air Force posts on Telegram that the app has “probably been subjected to hostile interference” and that there is no radiation threat.
- 23:53 – All-clear messages start arriving, one for each fake Kyiv alert.
- About 02:00 – The app’s Telegram channel says service is gradually returning, with the display of targets suspended while extra security measures go in.
So the official correction inside the app took about 66 minutes. Meanwhile, regional governors filled the gap on their own channels. Svitlana Onyshchuk in Ivano-Frankivsk said the region was calm. In Vinnytsia, Natalia Zabolotna warned residents not to click a link in the message, because it could be a phishing attempt.
The Air Alert app is wired into hardware
Ajax Systems and the Ukrainian studio Stfalcon built the app in a single day and launched it on March 1, 2022, with backing from the Ministry of Digital Transformation. According to Stfalcon’s own description, the chain is short. An operator at a regional military administration receives word of a threat, enters it into a console, and the app pushes it to everyone who chose that region.
Four years on, that chain reaches further than phones. In a March 2026 anniversary post, Ajax said the service had 46 million downloads and more than 6.7 million daily active users. It also said alarms pass via API to Ajax security systems, so physical Ajax sirens can sound, and that the integration opens doors automatically at more than 400 shelters.
That is a useful design in a war where sirens do not reach every village. However, it also means a compromised feed is no longer just misinformation on a screen. The Lviv loudspeakers prove the point. Neither Ajax nor the ministry has said whether any connected sirens or shelter doors responded to Sunday’s fake signals.
Why silent mode didn’t protect anyone
When the app launched, Ajax stressed that the Air Alert app was the only service of its kind supporting “critical alerts”, meaning notifications that sound even when a phone is in silent or sleep mode. For a real missile strike at 3 a.m., that is the whole point. For an attacker, it is a megaphone. Millions of people who had muted everything else were still reachable.
Trust adds to the effect. Ukrainians respond to the Air Alert app daily, so its warnings carry authority that a random Telegram rumour never would. Notably, the clearest giveaway was the second message. It came in Russian, opened with a casual “Hi!”, and joked about a missile. An official warning would do none of those things.
How the Air Alert app breach compares with earlier false alarms
False alerts are not new, but the cause and the reach vary a lot. Here are four cases side by side.
| Incident | Cause | Channel hit | Time to correction |
|---|---|---|---|
| Hawaii, Jan 13, 2018 | Employee error during a drill | Official phone and broadcast alert system | 38 minutes |
| Russia, Feb 2023 | Hacked servers at private radio and TV stations | Regional broadcasts; sirens the week before | Ministry denial after the fact |
| Israel, Oct 2023 | Hacktivists abused a weak API | Third-party Red Alert app | Not published |
| Ukraine, Nov 1, 2026 | Suspected hostile compromise, cause not disclosed | Official state-backed app, plus loudspeakers in Lviv region | About 66 minutes in the app |
The FCC’s Hawaii report blamed human error and weak safeguards, and found the state had no plan for a quick correction. In Israel, the AnonGhost group exploited an API flaw in Red Alert: Israel, a popular app the state does not run, and pushed a fake nuclear warning. In Russia, the emergencies ministry said hackers had broken into private broadcasters’ servers.
Ukraine’s case combines the worst parts of each. It hit an official channel, as in Hawaii. It was deliberate, as in Israel. And it spilled into public audio, as in Russia. It also lasted longer than Hawaii’s false alarm, even though the Air Force denied the threat on Telegram before the all-clears went out.
Moscow’s alert app, a few hours later
Early on Monday, Russia’s Emergencies Ministry said its own mobile app had suffered a “massive cyberattack” that let attackers send false information, as Al Jazeera and the BBC reported. Atesh, a Ukrainian partisan group, claimed the hack on Telegram. A screenshot it shared, which the BBC could not verify, told users to stock up on food for three weeks and shelter in basements.
The ministry’s response is revealing. It said the app is “only an additional, ancillary news service” and that sirens, text messages, TV and radio were unaffected. Ajax used similar language back in 2022, calling its product “an additional tool, not a primary civil defence alerts source.” Both sides, in other words, describe their apps as backups. Yet in practice the Air Alert app now drives hardware. Ukraine’s strategic communications centre, SPRAVDI, blamed Russia for the original breach. No one has independently confirmed who carried out either attack. Both came minutes after a six-day local ceasefire around Oleshky, in the Kherson region, expired at 23:00.
Backups to set up if the Air Alert app goes wrong again
Officials gave the same advice on Sunday, and it applies to anyone in Ukraine or with family there. For context on checking attack claims as they spread, our earlier piece on what was confirmed about the Ras Tanura refinery attack claim walks through the same verification habits.
- Turn on government alerts. The ministry urged people to enable their phone’s built-in emergency notifications. On iPhone, the switches sit at the bottom of Settings, then Notifications. On most Android phones, look under Safety and emergency, then Wireless emergency alerts.
- Keep a second app. Officials told Kyiv residents to use the Kyiv Digital app, which kept working normally throughout.
- Follow your regional administration’s Telegram channel. Governors posted their own corrections there on Sunday night.
- Never tap links inside an alert. Real warnings tell you to take cover. They do not ask you to open a web page.
- Treat tone as a signal. Russian text, jokes or greetings in a civil defence message are red flags.
Social feeds will not save you here. As we noted when Pew measured how many people now get news on TikTok, platforms are quick but rarely first-party. During an alert, official channels are the only ones that count.
Questions Kyiv still has to answer
The app’s team said it “does not store or use personal data, so there is no threat to users.” That may be true, but it skips the bigger issue. Nobody has explained how the attackers got into the Air Alert app. Was it an operator console, the push provider, or the API that feeds sirens? Also unknown is whether the fix covers every connected device, or only phones.
Regulators elsewhere have pushed platforms to show their work after failures, as Britain’s Ofcom did in its data fight with Meta, TikTok and X. A public incident report would do the same for the Air Alert app. Millions of people rely on it every night, so they need to know where the weak link was, not just that the team has patched it.
