Zelensky confirms Ukraine hacked Russia's alert app after fake nuclear warnings hit both countries' apps

In Ukraine, Air Alert is a widely used app for air-raid warnings, and it was developed by private companies with the support of the Ministry of Digital Transformation. Users received false notices of radiation, a chemical threat, a nuclear attack and street fighting in Kyiv. The messages were badly written, in English with spelling and grammar errors and in a mix of Russian and Ukrainian. One read, in Russian: "Hi! There will be a nuclear threat across Ukraine. Do not worry, the Oreshnik is incoming," a reference to a Russian intermediate-range missile.

The Ukrainian Air Force confirmed at 11:02 pm that the alerts were false, saying the app appeared to have been "subjected to hostile interference" and that there was no radiation threat. The developers said that "unauthorized interference" had occurred and switched off push notifications and the app itself for a time. The Air Force spokesman, Yurii Ihnat, said the hack had no effect on security or defence operations, because Air Alert is not part of the military command systems. The service has since been restored.

In Russia, the Emergencies Ministry said hackers used its mobile app to send a false alert to users in 33 of the country's 89 regions at about 2:45 am Moscow time. The message warned of nuclear warheads being launched across the country and told residents to stock up on food for three weeks and shelter in basements. The ministry said the attackers exploited a vulnerability in the app's administrative panel, that it isolated the affected services, and that the wider public alert system, which uses text messages, broadcasts, sirens and loudspeakers, kept working normally.

Who says what

The most important statement came from Mr Zelensky. Asked by the US broadcaster whether Ukraine had responded by hacking Russia's emergency mobile application, he said it had. "We only respond on their attacks," he said, and called the attack on Ukraine's system "their personal attack against our people, civilians." He said Russia had repeatedly carried out cyberattacks meant to harm civilians, naming Ukrainian banks and the pension system as earlier targets. He did not describe how the Russian app was breached, and no evidence has been published for either side's claims.

That makes the two halves of the story different. The Russian-side hack is now acknowledged by Ukraine's president as an act of retaliation. The Ukrainian-side hack is attributed to Russia by Ukrainian officials, but that attribution has not been independently confirmed, and Russia has not commented on it. Two other claims are unverified: a Russian messaging channel said a group calling itself Hitcore had claimed the Ukrainian breach, and a pro-Ukrainian group, Atesh, posted a screenshot of the Russian alert.

The Kremlin's spokesman, Dmitry Peskov, said all state agencies face constant cyberattack threats, a growing number of them using artificial intelligence, and that government bodies must improve their cybersecurity. Ukraine's Center for Countering Disinformation told residents to follow other emergency channels and to rely on physical alerts while the problem was fixed, and the air raid alert channel warned users not to click links in suspicious notifications.

Why it matters

The hacks matter more than a prank would, because the whole value of an alert system is that people believe it. A false warning of a nuclear attack sent to a population in a war zone can cause panic, dangerous movement and, afterwards, a risk that real alerts are ignored. That is the second-order harm: a system that has once lied to its users is trusted a little less the next time it warns of a missile.

An acknowledged retaliation changes the picture. Until Mr Zelensky spoke, the incidents could have been the work of freelance groups on either side. Now one of them is described by a head of state as a deliberate answer to the other, which turns alert systems, built to protect civilians, into targets in a tit-for-tat between the two countries' cyber capabilities. That is an analysis and not a finding, because neither government has published evidence of who did what.

The technical lesson is plain, and the Russian ministry's own account supports it. An administrative panel that can send a message to every user is a single point of failure. Alert services are built to be fast and to reach everyone at once, so the access that makes that possible has to be protected more strictly than any other part of the system. Two-person approval for mass messages, limits on what a panel can send without a second sign-off, logging that is checked in real time and a clear way to retract a false alert are common safeguards for systems of this kind.

For readers, the practical advice is the same as the officials gave. Do not act on a single alert, especially one with spelling errors or an odd tone. Check it against a second channel, such as official social media accounts, local broadcasts, sirens, or the authority's own website. Do not open links in notifications you did not expect. Russia's ministry said its wider alert network of text messages, broadcasts and sirens kept working normally, which is the reason governments keep those channels alongside the apps. Officials in Ukraine said the military systems were untouched, but the hacks landed on the night a truce expired and ahead of the talks planned in Abu Dhabi for 10 and 11 November, and whether they were meant as a message, a test or a response is a question the investigators in Kyiv and Moscow have not answered.