Short answer
Late on 1 November 2026, Ukraine's Air Alert app sent fake radiation, chemical and street-fighting alerts, and Ukraine's Air Force said it had likely been compromised. Russia's emergency ministry then said its own app faced a cyberattack that spread false information.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Air Alert (Ukraine) and EMERCOM app (Russia) |
|---|---|
| Incident type | Account takeover |
| Status | Under investigation |
| Sector | Public warning and emergency alert apps |
| Country | Ukraine and Russia |
| Detected | 2026-11-01 |
| Disclosed | 2026-11-01 |
| People or records affected | Ukraine's Air Alert app had 6.6 million active users as of January 2026, per The Record. The number who received the false alerts is not stated |
What data was exposed
- No user data theft has been reported for either app
- The apps were used to push false warnings, including nuclear, chemical and street-fighting alerts
What happened
Late on Sunday 1 November 2026, users of Ukraine’s Air Alert app, including people in Kyiv, received alerts that were not real. Al Jazeera reports they warned of nuclear and chemical threats, street fighting, and a deployed Russian Oreshnik missile. The Record says the alerts used the app’s familiar voice.
Ukraine’s Air Force said the app had likely been compromised by the enemy and told residents to ignore the messages. Ukraine’s State Emergency Service said the national warning system was working normally. The developers disabled push notifications and suspended the service, then began restoring it on Monday. Push notifications and basic threat indicators returned while the map display stayed off.
The Russian side
On Monday 2 November, Russia’s Ministry of Civil Defence, Emergencies and Disaster Relief said its app faced a “massive cyberattack” that spread false information, without naming suspects. Al Jazeera reports fake warnings that nuclear warheads had been launched at all regions and that people should stock food for three weeks and hide. The ministry said sirens, text messages and broadcasts were unaffected.
Claims, not confirmations
According to The Record, a previously unknown group, Hitcore Corp, claimed the Ukrainian breach through a Telegram channel linked in one alert, and a group calling itself DC8044 claimed the Russian one. Neither claim has been independently verified. Ukraine’s Center for Strategic Communications attributed its incident to Russia, citing a Russian-language message among the fakes. Al Jazeera says this appears to be the first time either country’s official alert app has been hacked.
The Kyiv Independent was also hit days later. See our post on its website and newsletter hack.
Data exposure
No theft of user data has been reported for either app. The apps were used as a channel to push fake warnings.
What people should do
Check unexpected alerts against official channels, update apps only from official stores, and avoid following links or Telegram channels in suspicious alerts. Fear-driven messages are a favorite pretext for scammers, so read our guides to phishing messages and government impersonation scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Panic-driven scam and disinformation messages that copy the look of official alerts and link to Telegram channels or donation pages.
- Fake 'app update' prompts or lookalike alert apps that claim to fix the problem.
- Fraudulent 'emergency relief' or shelter-booking messages that exploit fear.
What to do if you are affected
- 01Verify any unexpected alert with official channels such as the national emergency service, not through links inside the message.
- 02Update Air Alert only through the official app store, and do not install files sent via messaging apps.
- 03Do not follow Telegram channels or links named in suspicious alerts.
- 04Do not forward unverified alerts. Check them first.
Frequently asked questions
What did the fake Ukrainian alerts say?
Al Jazeera reports they warned of nuclear and chemical threats around Kyiv, street combat, and claimed Russia's Oreshnik missile had been deployed. Ukraine's Air Force said there was no radiation threat.
Who is behind the hacks?
Not independently confirmed. The Record says a previously unknown group called Hitcore Corp claimed the Ukrainian app breach, and a group calling itself DC8044 claimed the Russian one. Ukraine's Center for Strategic Communications blamed Russia. Russia's ministry named no suspects.
Is the national warning system affected?
Both governments say no. Ukraine's State Emergency Service said the national warning system worked normally, and Russia's ministry said sirens, text messages and broadcasts continued. The apps are supplementary.
Is Air Alert working again?
Per The Record, developers disabled push notifications and suspended the service, then restored push notifications and basic threat indicators by Monday while the map display stayed disabled.
Sources
- Nuclear radiation in Russia, Ukraine? No, just hacked warning alerts, Al Jazeera, 2026-11-02
- Hackers hit Ukraine and Russia's emergency apps, send fake nuclear alerts, The Record, 2026-11-02
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.