Hackers hijack Ukraine's air raid alert app with fake radiation warnings, state-built emergency system tells millions to shelter without verification, air force directs users to another centralized channel

Images

bnonews.com

Ukrainians woke on Sunday to emergency alerts warning of radiation hazards, chemical attacks and street fighting in Kyiv, Kharkiv and Zaporizhzhia — none of which were real. The country's air force confirmed there was no radiation threat and said the Air Raid Alert app, the tool millions rely on to seek shelter during Russian missile and drone attacks, had likely been subjected to "enemy influence."

The false messages covered the full register of catastrophe: a nuclear hazard, a chemical hazard and street fighting in Kharkiv, artillery fire in Zaporizhzhia, radiation warnings in the capital. Some reports suggested the bogus alerts even triggered sirens. The app was developed by Ajax Systems and Stfalcon with support from the Ministry of Digital Transformation, and its value lies precisely in that state backing: when the alarm sounds, people move to shelter without checking anything else.

That trust is the vulnerability. A population that has been trained for nearly four years to treat the app's notification as the final word on incoming missiles cannot verify the signal independently — the entire system works only because no one is expected to second-guess it. Whoever compromised the app did not need to fire a single weapon to fill basements with panicked civilians, or to teach millions that the next genuine alert might also be false. The air force's response was to direct users to its official channel: a centralized system replaced by another centralized system.

Western governments are building similar infrastructure — nationwide emergency alerts pushed to every phone, designed to be trusted instantly and questioned never. Ukraine has just run the penetration test.