Ukraine’s Air Alarm app pushed the highest-level nationwide raid warnings shortly before 11 p.m. local time. Then came messages about radiation, chemical attack and street fighting in Kyiv.
None of it was real. Officials in Kyiv said the app appeared to have been hijacked, that no radiation danger existed, and urged the public to keep calm. The alert sequence began at 22:47 with a claimed radiation threat in the capital. A minute later a message in Russian said a nuclear alert would cover the whole country and not to worry because “it’s Oreshnik flying,” a reference to Russia’s intermediate-range ballistic missile.
Two more at 22:49, then all-clear
One warned in Ukrainian of a chemical attack and told residents not to go outside. Another reported street fighting. Red, orange and green messages reached phones before all-clear notices arrived at 23:53. Radiation hazard speakers activated in the Lviv region with no threat behind them. The digital ministry took the app offline for maintenance, describing it as having apparently been compromised.
Hours later Russia’s emergency situations ministry reported its own app had taken a massive cyberattack. Ukrainian outlet UNN, citing the partisan group Atesh, said fake nuclear alerts went out inside Russia, including a purported screenshot claiming warheads on Ukrainian drones had launched at every region.
The security trade-off
Neither side’s claims are independently confirmed. The incident exposes an awkward problem: disabling a compromised alert channel stops false warnings but also removes a live source of real ones. Sirens, official channels and broadcast fallbacks have to carry that gap, and users should treat links inside alert messages as phishing until verified.
