Hacked nuclear alerts expose soft civil defense systems

Nina lay on her bed in Kyiv late on Nov. 1 and wondered what was coming. The Air Alert app on her phone had just warned of nuclear radiation. “I was briefly terrified,” she told The Guardian.

The false push notifications arrived between 22:47 and 22:49 Kyiv time. Phones showed a radiation threat in the capital, a nuclear alert that named Russia’s Oreshnik missile, a chemical attack warning, and street fighting in Kyiv. The messages mixed Ukrainian, English, and Russian and carried spelling and grammar errors. One Russian-language notice, reported by the Associated Press, read: “Hi! There will be a nuclear threat across Ukraine. Do not worry, the Oreshnik is incoming.” A Telegram link inside the traffic pointed to a group calling itself Hitcore, or Hitcore Corp, which claimed responsibility for the breach.

The Ukrainian Air Force answered within about 10 to 15 minutes. “There is no radiation threat! Remain calm,” it said in a translation carried by BNO News. On Telegram it added: “There is no radiation threat! Stay calm and follow our updates on our channel.” Officials said the app appeared to have been subjected to hostile interference. Developers at Ajax Systems and Stfalcon, working with Ukraine’s Ministry of Digital Transformation, disabled push notifications and temporarily suspended the service. The false notices were cleared within about an hour. Gradual restoration began around 2 a.m. on Nov. 2. Yurii Ihnat, spokesman for the Ukrainian Air Force, said the hack had no impact on security operations and that Air Alert is not affiliated with military command systems. Kyiv’s separate Kyiv Digital app remained functional throughout.

Olena, another Kyiv resident, told the BBC her first thought was “oh my god, I’m not prepared for this.” She was ready for blackouts and cuts to central heating and water supply, “but not for nuclear attack.” When her husband received further alerts about street fighting and a message written in Russian, the pattern became clear. “After that I understood that somebody had attacked the app, because all notifications we get in Ukrainian.” Ukrainian social media answered the scare with jokes about sabers and street fighting.

Oleksander Merezhko, chair of the Ukrainian parliament’s foreign affairs committee, told the BBC the episode did not produce panic or extreme reactions. People in Kyiv were used to practically nonstop alerts, he said, and the Russian-language wording “immediately aroused suspicions.” It was “part of cyber war,” and Ukrainians understood the possibility. Herbert Lin, a Stanford University cyber policy scholar, told the BBC he thought it was the first time an official Ukrainian information app had been hacked in this way, “but I suspect it won’t be the last.”

Roughly two hours later, around 2:45 a.m. Moscow time, Russia’s EMERCOM emergency app was breached. False alerts warned of nuclear warheads, told citizens to stockpile three weeks of food, and ordered them into basements. The messages contained profanity. A group calling itself DC8044, based in Kyiv, claimed it had gained access through the app’s API. Russia’s Emergency Service said: “We once again urge citizens not to click on links from unknown sources and not to spread unverified information.” Kremlin spokesman Dmitry Peskov said, “All government bodies must take steps to improve the cybersecurity of our digital resources.” No official source named who carried out the Ukrainian breach. The record does not show Russia explicitly blaming Ukraine for that specific incident.

Air Alert launched in 2022 and had 6.6 million active users as of January 2026. It runs separately from military command systems, which means it does not automatically inherit the same defenses. The Russian ministry insisted its primary public warning system—sirens, loudspeakers, text messages, television, and radio—remained intact and that the mobile app was only a supplementary channel. That distinction is the practical one. A single popular app that millions treat as authoritative becomes a single point of failure the moment an adversary or a hacktivist group can seize it.

Dr. Maxim Starchak, a nuclear policy expert at Queen’s University, told the Express the risks of cyber intrusion into nuclear command and control are real but minimal in practice. Early-warning systems could in theory be manipulated to generate false signals, yet the decision to launch does not rest on one subsystem. Radar and political leadership still have to confirm an attack and its source. Professor Anthony Gless, a security expert, argued more broadly that a devastating cyber strike on critical national infrastructure could serve as the opening move of a larger assault and that NATO should answer cyber attacks with cyber attacks of equal weight. The record carries those assessments; it does not settle attribution for the Nov. 1 alerts.

The strongest conservative case sits in the facts already on the table. When a government partners with private firms to field a warning tool that 6.6 million people trust with their lives, securing that tool is a core duty of public safety. Limited government does not mean soft government on the few functions only the state can perform. Civil defense is one of them. National sovereignty includes the ability to protect the channels that tell citizens when to take cover. Free enterprise built the app through Ajax Systems and Stfalcon; the Ministry of Digital Transformation lent official support and therefore shares the obligation to harden what it promotes. Ordinary users absorb the cost when those systems fail—in the minutes Nina spent lying on her bed, in the preparation Olena realized she did not have, and in every future alert that now has to fight residual doubt.