"The Air Alert app has likely been compromised," the Air Force wrote via Telegram at around 2100 UTC, urging calm and insisting "There is no radiation threat! Stay calm, follow our messages on our channel!"
The Ukrainian alert hit first — timing and immediate response
According to public statements and social-media messages, Ukrainian users began receiving false emergency warnings at roughly 2100 UTC on Sunday. The bogus alerts covered a range of threats — street fights in Kyiv, chemical attacks and radiation hazards — and one of the earliest messages was written in Russian and referenced the "Oreshnik" missile, a detail that officials cited as an early signal the warnings were not genuine.
Ukraine's Air Force quickly posted the line above on Telegram and the Ministry of Digital Affairs issued a public announcement reminding citizens how to receive official emergency warnings while its “Alarm!” app was down. The ministry listed enabling iOS and Android emergency alerts, relying on state-controlled sirens and other official sources such as the government's official social-media accounts as alternatives while the app was being restored.
Russia's Ministry of Emergency Situations: a "massive cyberattack" and a rapid recovery
At about 0030 UTC Monday, Russia's Ministry of Emergency Situations confirmed that its mobile app had been abused, posting via Telegram: "Attention! The Russian Ministry of Emergency Situations' mobile app has been subjected to a massive cyberattack, allowing attackers to send fake information to the public." The ministry said work was underway to patch the vulnerability and restore normal operation, and issued an update roughly 90 minutes later saying the app was once again functioning normally.
The ministry underscored that an attack on the app is not the same as a compromise of the national alert system, stressing that "Citizens are alerted through primary channels: regional and municipal alert systems (sirens, loudspeakers), communication networks (SMS messaging), and television and radio broadcasts. The mobile app is merely an additional, supporting information service."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat the false messages said — Oreshnik, P1-Sun, and misplaced nuclear warnings
The fabricated alerts differed in wording but shared an alarmist theme. In Ukraine, they raised fears of chemical and radiological incidents and referenced street-level violence. In Russia, the messages warned of impending nuclear strikes "at all regions of Russia," and cited "P1-Sun," described in those alerts as the name of a Ukrainian attack drone. The presence of specific, unusual names in both sets of messages — "Oreshnik" in the Ukrainian-targeted alerts and "P1-Sun" in the Russian-targeted alerts — was noted in official statements and in reporting as a marker that the messages may have been disinformation rather than authentic warnings.
Oleksander Merezhko, the Kherson ceasefire and public readiness
Oleksander Merezhko, who chairs the Ukrainian parliament's foreign affairs committee, told the BBC the incident was "almost certainly part of Russia's cyber war." He commented: "It's a very unpleasant fact but it is part of cyber war and people in Ukraine understand that," adding, "It is possible and we are quite prepared for such possibilities." Ukraine's announcement about the alert-app compromise arrived almost simultaneously with the official end of a six-day ceasefire in Kherson that had allowed evacuations from the Russian-occupied city of Olehsky. The ceasefire officially ended at around 2100 UTC — roughly when Ukrainians began receiving the fake alerts.
How emergency agencies and civilians were directed to proceed
Both governments framed the mobile apps as supplementary to primary, established alert channels. Russia's ministry explicitly listed regional and municipal sirens and loudspeakers, SMS messaging and television and radio as the primary means of alerting citizens. Ukraine's Ministry of Digital Affairs echoed that guidance, urging people to enable iOS and Android emergency alerts and to consult state-controlled sirens and official government social-media accounts while the "Alarm!" app was unavailable.
The incidents together underline a shared fact stated by official sources in both countries: false or manipulated messages on mobile alert applications can create acute public alarm, but app compromises do not equate to failure of primary national alerting systems. Both sides reported restoration or mitigation actions within hours, and neither side's official statements included an explicit attribution that tied the other's government to the attack on its app.
