Over the night of 1 to 2 November 2026, attackers broke into the official emergency alert apps of Russia and Ukraine. They used the apps to push false warnings of a nuclear launch. Russia’s Emergency Situations Ministry, MChS, also called Emercom, and Ukraine’s Air Force each confirmed on their own channels that their app had been compromised. Both governments said the warnings were false and that no real nuclear threat existed.
For a security team, the detail that matters is not the wording of the fake alert but the channel it rode in on. Millions of people in both countries keep these apps installed specifically so they do not question what the app tells them. The table below lines up the two incidents using only what each government’s own statement confirms.
Russia’s App Against Ukraine’s App, Side by Side
| Category | Russia (MChS app) | Ukraine (Air Alert app) |
|---|---|---|
| What was hacked | The administration panel used to send push alerts in the MChS mobile app | The notification system of the Povitryana Tryvoha (Air Alert) app |
| False message pushed | A warning that nuclear warheads had launched against Russia, telling people to gather food and shelter in basements | A Russian-language warning of a nationwide nuclear alert, plus false radiation and chemical warnings for Kyiv |
| Who confirmed it, and when | MChS, in a Telegram post that morning, 2 November | Ukraine’s Air Force, on its own Telegram channel, the evening of 1 November |
| Current status | MChS said it found the flaw and was working to close it; the main public alert system kept operating normally | Notifications were switched off while the Air Alert app’s own channel said it reviewed unauthorized interference |
Read this table as a restatement of each government’s own words, not as our independent technical check. We did not test either app ourselves. The “what was hacked” and “current status” rows come from MChS’s and the Air Force’s own statements. Where a government has not said something, for example exactly how the attacker reached the sending system, the sections below say so instead of guessing.
What Russia’s Emergency Ministry Confirmed
MChS said in a Telegram post that morning, 2 November, that a cyberattack had hit the administration panel of the MChS Russia mobile app. Through that panel, a false message reached users in 33 regions of Russia at about 02:45 Moscow time. MChS said it found the flaw the attacker used and was working to close it, and that it reported the incident to the National Coordination Center for Computer Incidents.
MChS also said its main public alert system kept operating normally throughout, separate from the compromised app. The ministry’s own post did not quote the fake message itself. Screenshots that later circulated, described by Meduza and other outlets, showed a warning that nuclear warheads had launched against Russia. Those accounts said the message told people to gather food for three weeks and shelter in basements, a detail MChS’s own statement did not confirm or deny.
What Ukraine’s Air Force and the Air Alert App Confirmed
Ukraine’s Air Alert app spoke first. On its own Telegram channel, it said outside parties had carried out unauthorized interference in the app’s operation, and that push notifications were switched off while the incident was checked.
Ukraine’s Air Force then said, in a statement that firmed up over the evening of 1 November, that the Air Alert app had been hacked. Users had seen false warnings of a nationwide nuclear alert, plus radiation and chemical threats aimed at Kyiv. The Air Force said it had issued no such warnings on its own official resources that evening.
What Is Confirmed, and What Is Still Unclear
Three things are confirmed directly by both governments. Neither country’s alert system detected or declared an actual nuclear threat; both said the warnings were false. Each incident involved an attacker reaching the back end of an app meant to be one-way and trusted. Each government said it took the compromised part offline while the rest of its alerting kept working.
What neither government has fully confirmed in writing is whether the two break-ins are connected, or who carried them out. MChS’s own Telegram statement does not mention Ukraine or name an attacker. The Air Force’s written statement, posted at 23:02 on 1 November, also did not name a country.
The next morning, though, in a televised telethon appearance reported by Ukrainian outlets, Air Force spokesman Yuriy Ihnat went further, saying “the Russians” carried out the attack. That is a spokesman’s own attribution, short of a formal written confirmation from the Air Force, and it still sits below MChS’s written statement, which names no one.
Ukraine’s Centre for Strategic Communications (SPRAVDI) separately blamed Russia in a social media post, a government communications office’s own claim rather than a technical finding. Outlets covering the story also noted that Ukraine’s incident happened a few hours before Russia’s, though no government statement we read draws a technical link between the two.
The two incidents also landed just after a local truce in Ukraine’s Kherson region had ended. That timing is circumstantial. No government statement ties the alert-app hacks to the end of that truce, and we treat it as context rather than a confirmed link.
Why This Matters Beyond the Two Apps
Both incidents show the same pattern. An attacker does not need to reach a missile system to frighten a population; reaching the software that sends official alerts is enough. The damage here is public confusion, not a direct technical loss. That puts this closer to hacktivism, where the goal is visibility and disruption, than to an attack on physical infrastructure.
It also fits a wider pattern our coverage has tracked. State and state-linked actors increasingly target the channels a government uses to reach its own public, not only the networks that hold its data. We looked at that shift in our look at how nation-state cyber threats are evolving.
A similar gap showed up recently in our coverage of the Rosstat hack claims. There, a Russian agency’s own confirmed account of a breach differed sharply from the hacking groups’ version of events.
For any organization that runs its own public-facing alerting, to customers, employees or citizens, this weekend’s lesson is simple. Treat the sending system itself as a target, not just the content it carries. Confirm an unusual alert through a second channel before acting on it, the same gap both MChS and Ukraine’s Air Force had to close this weekend.