It began just before eleven o’clock on a Sunday night, when the strange, insistent hum of a phone is never a welcome sound. Across Kyiv and in other regions of Ukraine, thousands of screens lit up with official-looking emergency alerts, each one carrying a different but equally terrifying message. There was a radiation threat. There was a chemical attack. There was danger of street fighting in certain areas. One message claimed that Russia had launched an Oreshnik hypersonic missile—a weapon capable of carrying a nuclear warhead—and that a nuclear alert had been declared throughout Ukraine. For a few minutes, the thin line between fear and fact disappeared. People in their living rooms, in their kitchens, in beds beside sleeping children, stared at their phones and wondered if this was the moment they had dreaded for years. Then, just as suddenly, another notification appeared: all clear. And then another warning. And again all clear. It was chaos, but not the chaos of bombs. This was a cyberattack, a digital assault aimed at the one thing that cannot be rebuilt overnight: a nation’s sense of safety. Ukraine and Russia both reported that their emergency alert applications had been compromised overnight. Both countries said their apps had been hacked. For Ukraine, the timing felt particularly cruel. A six-day local ceasefire in a small part of southern Ukraine, brokered by United States first lady Melania Trump, had just expired. It had been the longest pause in fighting since Russia launched its full-scale invasion in 2022, a flicker of hope in a long and brutal war. And now, in the hours after that truce faded, the phones began to scream.
The fake alerts were not subtle. They were not half-hearted attempts at confusion. They were carefully crafted to sound like official warnings, written in Russian rather than Ukrainian, which immediately raised suspicions. Under Ukrainian law, all official communications must be conducted in Ukrainian, and the use of Russian was a glaring clue that these messages had not come from Kyiv’s own emergency systems. The alerts covered Kyiv and other regions, warning about radiation and chemical exposure, and even about street fighting in areas where no fighting had occurred. One fabricated announcement claimed that a Russian Oreshnik missile had been fired at Ukrainian territory and that, as a result, a nuclear alert had been declared across the entire country. There is nothing more terrifying to a population that has already endured rocket attacks, drone strikes, blackouts and cold winters than the words “nuclear alert.” The terror is immediate, visceral, almost primal. For a few long minutes, people did not know what to believe. Some rushed to windows. Others called their families. Many simply froze, waiting for the next message to tell them whether to run or to breathe. Soon afterward, the Ukrainian air force posted on the Telegram messaging app that the system appeared to have been hacked by Russia. It pointed out that the alerts were sent in Russian, whereas Ukrainian is mandatory for all official communications in the country. The air force said the app seemed to have fallen under enemy influence. Then came the most important words of the night: “There is no radiation threat!” The statement urged people to stay calm and to follow updates on official channels. Each false alert was followed shortly by an all-clear message, but the damage had already been done. The Ministry for Digital Transformation said the emergency app would be temporarily suspended, while other methods of warning the public, including the familiar wail of air raid sirens, continued to operate normally.
To understand why this hack mattered so much, one must understand the strange landscape of this war. This is not a conflict fought only with tanks and missiles. It is also fought with cables and signals, with hacked websites and intercepted communications, with disinformation campaigns designed to weaken the human spirit as much as the front lines. The false alerts came at a particularly delicate moment. A six-day local ceasefire in a small part of southern Ukraine had just expired, raising hopes and fears in equal measure. This truce, brokered by Melania Trump, was unprecedented in its length—the longest pause in fighting since Russia launched its full-scale invasion in 2022. It was limited in scope, covering only a small area in southern Ukraine, but it carried enormous symbolic weight. For six days, some families had allowed themselves to imagine a world without explosions, without the sound of sirens at dawn, without the dread of opening a phone to see another alert. Then the truce expired. And as if on cue, the emergency alert systems were compromised. In the minds of Ukrainian officials, this was no coincidence. The attack appeared designed to seize the attention of a weary nation at the exact moment when attention was most fragile. It was a way of saying, without a single bullet, that no peace is safe, no break is guaranteed, and no phone can be trusted. It was psychological warfare, delivered directly to the screens of civilians, bypassing the front lines entirely. The goal was not to cause physical casualties but to create an atmosphere of uncertainty and fear. The goal was to make people wonder, even after the all-clear messages arrived, whether the next alert might be real. The goal was to erode trust in the very tools designed to protect people.
In the end, however, the attack may have backfired. In Kyiv, residents largely downplayed the effect of the hack. One of them was Artem Pyndyk, a 37-year-old businessman, who said the messages briefly surprised him before he understood what was going on. He described the moments after the first alert, the quickening heartbeat, the instinctive reach for a phone, the flood of questions. But then, he said, he recognised the patterns. He had seen countless messages before, both real and false, both official and unofficial, and he had learned to distinguish between them. “This did not trigger the kind of reaction in society that they expected,” Pyndyk said. He added that the family members and friends he contacted had not panicked either. There was something remarkable in his words, a quiet defiance that has come to define life in wartime Ukraine. A nation that has survived occupation, missile barrages, power cuts and winter blackouts is not easily shaken by a fake notification on a phone. People have developed a kind of resilience that is almost impossible to measure. They have learned that panic is a luxury they cannot afford. They have learned to check official channels, to cross-reference information, to wait for the all-clear before changing their plans. This is not to say that the hack did not hurt. It did. Every false alert wears down the nervous system just a little more. Every warning that turns out to be fake makes the next real warning slightly harder to believe. That is the insidious nature of information warfare. But in Kyiv, at least, the attack seemed to produce more contempt than fear. People did not rush to shelters. They did not stockpile water or prepare for nuclear fallout. They checked the Telegram channels, saw the air force’s announcement, and went back to whatever they were doing. Some even laughed.
The official response was quick and firm, but it also revealed how vulnerable civilian communications systems have become in this war. Ukraine’s air force publicly accused Russia of orchestrating the hack, noting that the fabricated alerts were sent in Russian, in violation of Ukrainian language rules for official communications. The Ministry for Digital Transformation announced that the emergency app would be temporarily suspended while security specialists investigated the breach. The decision was not made lightly, because the app had become an important part of daily life, a digital siren that could reach millions of people instantly. But the risk of further false alerts was too great. The app was switched off, and officials returned to older, more robust methods of warning the public. Air raid sirens still worked, blaring across cities and villages. Telegram channels and television broadcasts continued to provide updates. And, in a way, the suspension of the app was itself a valuable lesson. It reminded people that no single tool is infallible and that the most important emergency alert system is the human one: neighbours warning neighbours, friends checking on friends, communities sharing information at the speed of trust. The fact that Russia also reported its emergency alert app being compromised added another layer of strangeness to the incident. Both countries, locked in a brutal war, woke up to discover that their digital warning systems had been tampered with. Each side blamed the other, or at least pointed fingers, and the truth remained murky. What was clear, however, was that cyberattacks on civilian infrastructure have become a normal part of modern warfare. It is no longer enough to protect power plants, bridges and hospitals. Countries must also protect the invisible systems that deliver life-saving information to ordinary people.
As the night wore on and the all-clear messages faded into the quiet hum of the city, life in Kyiv slowly returned to something resembling normal. Lights went back on in apartments. Tea was reheated. Children were tucked back into bed, even if their parents stayed awake a little longer, staring at their phones. The fake nuclear alert had lasted only a few minutes, but its echoes would last much longer. It was a reminder that in the twenty-first century, war is not always a distant boom on the horizon. Sometimes it is a vibration in your pocket, a glowing screen in the dark, a voice in your language that tells you everything is over—until another voice tells you it was all a lie. The six-day local ceasefire had expired, and with it the brief dream of a broader peace. The actual fighting, the artillery duels, the drone patrols, the soldiers in trenches, all of that continued. But something else continued too: the stubborn refusal of ordinary people to be terrorised into submission. Artem Pyndyk’s words captured it better than any official statement. The hackers expected panic. They expected hoarding, screaming, phone calls to relatives, a ripple of fear across social media. Instead, they got a shrug. They got a population that had been tested before and would be tested again. They got a glimpse of a society that has learned, through bitter experience, that the only way to survive is to stay calm, to verify, and to carry on. The emergency app would probably be restored in time, hardened against future attacks. New warnings would be issued, some real, some false. The war would continue, in all its forms. But in Kyiv, in the early hours of a sleepless morning, the verdict was already clear: the attack had failed. People were not afraid. They were tired, yes. They were angry, perhaps. But they were not broken. And as long as that remained true, no amount of hacked notifications could do what missiles and tanks had failed to do. The human spirit, it turns out, is the hardest system of all to compromise.