Unknown hackers targeted Ukraine’s nationwide emergency alert app late on Sunday, sending residents warnings of an imminent nuclear strike and a chemical threat in Kyiv. The app said unauthorised parties had interfered with its operation, while Russian officials claimed hackers had also sent fake emergency alerts in Russia after gaining access to the emergency ministry’s app.
The messages, written in English with spelling mistakes as well as in Ukrainian, began shortly before 11pm local time. The app reported a high possibility of nuclear radiation and street-to-street fighting. Many residents ignored the warnings, assuming the app had been hacked. Others were frightened. “I was briefly terrified,” one woman, Nina, said. “I lay on my bed and wondered what was coming.” A message in Russian also claimed Ukraine was about to be struck by Oreshnik missiles, a ballistic weapon capable of carrying nuclear warheads that the Kremlin has used three times before.
The cyberattack began shortly before the expiration of a six-day ceasefire in the southern city of Kherson, brokered by US first lady Melania Trump, during which hundreds of civilians were evacuated from the Russian-occupied town of Oleshky. Ukraine’s emergency app announced that “unauthorised parties” had interfered with its operation, temporarily suspending the channel and warning users not to click links in suspicious notifications.
Both sides hailed the ceasefire as a success. Ukraine’s ombudsman, Dmytro Lubinets, who visited Oleshky to coordinate the mission, said it could be repeated on other parts of the front line. However, Ukrainian commander Dmitry Pulinets told Sky News that Russian soldiers had previously been unable to drive in Oleshky because of the threat from Ukrainian kamikaze drones, but now had that opportunity, and that the movement had been happening constantly for the last few days. Footage shared with Sky News showed Russian soldiers deploying heavy military equipment and delivering ammunition. Kremlin spokesman Dmitry Peskov said there were no plans for another truce elsewhere, and said it was “standard practice” for army units to regroup in such circumstances. Kherson’s military administration said a Russian drone hit a hospital at 7.40am; officials said nobody was hurt.
The perpetrators of the hack remain unclear. The Russian Telegram channel Mash, which has links to the security services, said it had spoken to representatives of a group called Hitcore, who claimed responsibility. The report could not be verified.
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
§
Analysis
Why This Matters
Disruption of emergency alert systems weaponises information warfare directly against civilian populations, eroding trust in critical infrastructure.
The Oleshky ceasefire showed both the potential and the perils of local truces; Russia used the pause to resupply, potentially shifting the tactical balance on the Kherson front.
The dual targeting of the app against both Ukraine and Russia muddies attribution, leaving open the possibility of a third-party provocation.
Background
The ceasefire in Oleshky was the most significant local pause in fighting since the full-scale invasion began in 2022, brokered by US first lady Melania Trump. It allowed for a civilian evacuation from the Russian-occupied town, but Ukrainian commanders say it gave Russian forces the cover to freely move heavy equipment and rotate in new troops in a city they had previously avoided due to drone threats. Ukraine’s emergency app is a central tool for civil defence, making its compromise a serious security breach.
Key Perspectives
Ukraine: Describes the hack as an act by “unauthorised parties” and notes that Russian forces used the subsequent ceasefire to reinforce in Oleshky, calling it a violation of the truce’s spirit.
Russia: Regards the hack as also having targeted their ministries, claims that military regrouping during a ceasefire is “standard practice”, and says there are no plans for a further truce elsewhere.
What to Watch
Whether the alert app can be secured and restored without loss of public confidence.
Whether the resupplied Russian garrison in Oleshky attempts offensive operations against Kherson.
Whether the White House or Kyiv pursues further ceasefire negotiations after the breakdown of the six-day pause.
12 claims in this story checked against 1 source: 7 supported.
Show each claim
SupportedHackers sent a fake nuclear-threat alert through Ukraine’s emergency app.World news | The Guardian: “Unknown hackers have targeted Ukraine’s nationwide emergency alert mobile app, sending residents in Kyiv a warning that they were at risk of an imminent nuclear strike.”
Sources say otherwiseThe false alarms followed the ceasefire.World news | The Guardian: “The alerts, which began shortly before 11pm local time … The ceasefire expired at 11pm on Sunday.”
SupportedRussia regrouped as the false alarms followed the ceasefire.World news | The Guardian: “There is evidence that the Russian army used the six-day ceasefire … to strengthen its positions in Oleskhy and to rotate in new troops.”
Sources say otherwiseThe cyberattack followed the expiration of the ceasefire.World news | The Guardian: “The alerts, which began shortly before 11pm local time … The ceasefire expired at 11pm on Sunday.”
Partly supportedThe six-day ceasefire was in the southern city of Kherson.World news | The Guardian: “Russia resumed its attacks on the southern city of Kherson, just hours after the end of a ceasefire during which hundreds of people were evacuated from the nearby Kremlin-controlled town of Oleshky.”
Partly supportedThe ceasefire was brokered by US first lady Melania Trump.World news | The Guardian: “The White House said was brokered by the first lady, Melania Trump”
Partly supportedHundreds of civilians were evacuated from Oleshky during the ceasefire.World news | The Guardian: “hundreds of people were evacuated from the nearby Kremlin-controlled town of Oleshky.”
SupportedUkraine’s emergency app said unauthorised parties had interfered with its operation and temporarily suspended the channel.World news | The Guardian: “the Ukrainian emergency app said “unauthorised parties” had interfered with its operation. The channel had been temporarily suspended, it said”
SupportedRussian officials claimed hackers also sent fake emergency alerts in Russia after gaining access to the emergency ministry’s app.World news | The Guardian: “Russian officials claimed hackers had also sent fake emergency alerts there after gaining access to the app of the ministry for emergencies”
SupportedNina said, “I was briefly terrified” and “I lay on my bed and wondered what was coming.”World news | The Guardian: ““I was briefly terrified,” one woman, Nina, said. “I lay on my bed and wondered what was coming.””
SupportedThe Kremlin has used Oreshnik missiles three times before.World news | The Guardian: “The Kremlin has used the ballistic weapon three times before, hitting the Kyiv region, and the cities of Dnipro and Lviv.”
SupportedKherson’s military administration said a Russian drone hit a hospital at 7.40am, and officials said nobody was hurt.World news | The Guardian: “Kherson’s military administration said a Russian drone hit a hospital at 7.40am. … Nobody was hurt, officials said.”
Correction
An earlier version of this story said the cyberattack followed the expiration of the ceasefire. The false alerts began shortly before the ceasefire expired at 11pm on Sunday.
