Hackers breach Ukraine's air raid alert app: fake radiation warnings, service restored

What happened

On the evening of 1 November unknown attackers carried out a cyberattack on Povitriana Tryvoha (Air Raid Alert), an app used daily by millions of Ukrainians. After the breach, notifications malfunctioned and users began receiving false warnings about radiation danger, street fighting and a chemical attack.

The app’s press service told Suspilne that teams from Ajax Systems and Stfalcon, working with the relevant services and ministries, quickly switched off push notifications and temporarily suspended the app. Overnight into 2 November it was gradually brought back online.

What works and what doesn’t

According to the developers, core functions were restored within about two hours. Push notifications about air raid alerts are again arriving as normal. The map shows yellow and red danger levels: yellow means a drone threat, red a massive drone or missile attack.

The recovery is not complete, however: displaying targets on the map is still unavailable and specialists are working on it. The team also said it is already strengthening the app’s protection to prevent similar incidents.

Are users at risk?

The press service stressed that the app does not collect, store or transmit users’ personal data or location, so no data leaked and users face no threat. Claims that user accounts or phones were hacked were described as untrue.

People who deleted the app in panic are advised simply to reinstall it from the official App Store or Google Play. Downloading it from other sources is not recommended.

A mirror incident in Russia

Overnight into 2 November it also emerged that the mobile app of Russia’s Emergencies Ministry had been hacked, with Russian citizens receiving messages about a supposed launch of nuclear warheads. No one has officially been named as responsible for either attack.

Background

Povitriana Tryvoha was launched in 2022 with support from Ukraine’s Ministry of Digital Transformation. Ajax Systems built it under emergency conditions in essentially a single day. Since then the app has become one of the main channels through which Ukrainians learn about the threat of missile and drone strikes.

What to do if an odd alert arrives

Cybersecurity specialists advise not to rely on a single source of warnings. It is worth also following sirens in your town and the official channels of regional military administrations and the Air Force. If the app sends an unusual message, for example about a chemical or radiation threat, check it against official sources before acting. At the same time, air raid alerts should never be ignored: when in doubt, it is safer to go to a shelter.

What next

The developers promise to fully restore functionality, including targets on the map, and to strengthen security. Updates should only be installed from official app stores.