Fake nuclear warning from hacked app sparks unease but not panic in Ukraine

ByDan Johnson Ukraine correspondent, Reporting fromKyiv.

Key points

• Within 15 minutes, Ukraine's Air Force issued a statement saying the alert app had been compromised and clarifying there was no radiation threat.
• Sofia Kochmar, 34, a mother-of-one living in the western city of Lviv, remarked she was initially concerned but swiftly questioned the authenticity of the alerts.
• Anastasiia Romanytska, a 29-year-old ballerina living in Kyiv, remarked she does not have the alert app installed but friends forwarded her the warnings.
• The alerts included some messages written in Russian, and one included a link to a Telegram channel apparently owned by a hacker group.
• Baliutov remarked it was additionally logical that Ukraine would have responded by launching a cyber-attack on the Russian emergency alert system.

Ukrainians have grown weary of the relentless alerts blaring from their phones and echoing through their streets, day and night, warning of Russian drones and missiles.

On Sunday night, the system delivered something to create them sit up and take note – a succession of more extreme threats that swiftly escalated to impending nuclear strikes, chemical attacks and combat on the streets.

But plenty of in the country did not take them seriously and doubted the veracity of the messages.

"The first thing I saw was the word 'nuclear' and that created me pretty nervous and scared. So my first thought was that something nuclear was actually flying toward us."

"But then the notification mentioned 'street fighting in Kyiv', and I thought, wait, no, that's impossible."

Meanwhile, the alerts included some messages written in Russian, and one included a link to a Telegram channel apparently owned by a hacker group.

Within 15 minutes, Ukraine's Air Force issued a statement saying the alert app had been compromised and clarifying there was no radiation threat. But it took more than an hour to matter "all clear" messages.

"My first reaction was, 'Is this some kind of joke?' But then my body reacted as if I was under stress. My heart began racing, and my stomach tightened up."

"Still, somehow I immediately realised that it wasn't something serious. Or maybe I just really wanted to believe that."

There are a number of apps delivering phone notifications of air raid warnings, with maps showing areas under threat, all using the same data as the official government-backed app.

Yevhen Baliutov, a cybersecurity expert at Kyiv School of Economics, informed the BBC it was clear to him the Ukrainian alert system was hacked by Russians, saying numerous Ukrainians had clicked a link included with the alerts leading to a Russian Telegram channel, potentially exposing them to further disinformation, phishing attempts or data breaches.

"This is a war, so it's no surprise that Russia will try to hack, will try to send us fake news, will try to manipulate, and will use that for their propaganda."

While both Russia and Ukraine are widely believed to carry out cyberattacks against one another, the informal language applied in the hoax alerts on Sunday pointed to so-called hacktivist groups. It could be aligned to Moscow or Kyiv but are not formally directed by either administration.

Baliutov remarked it was additionally logical that Ukraine would have responded by launching a cyber-attack on the Russian emergency alert system. Both sides have similar capabilities in cyber warfare, he continued.

Kochmar remarked after the initial concern, Ukrainians swiftly turned to joking regarding the incident.

"All our work group chats immediately blew up. Everyone began messaging each other, discussing what was happening. And what I discovered fascinating was how swiftly we turned the whole thing into a joke."

Although the impact of this incident had been limited, it illustrated the weakness of a crucial system, Baliutov remarked.

"It's particularly dangerous for Ukraine and for our residents. When developing such applications, we need to consider security from the particularly beginning, without skipping essential security measures. When millions of individuals rely on a service, we cannot afford to take shortcuts with security."

Notably, the authorities already faced the challenge of maintaining public alertness after four and a half years of war with ceaseless attack warnings sounding sometimes hourly. Now they must reassure individuals the systems in place to protect them are robust, trustworthy and should be followed.

Taken together, the developments around fake nuclear warning from hacked app sparks unease but not panic in point to a situation that is still moving, and the coming days should bring more clarity.