Ukrainians have grown weary of the relentless alerts blaring from their phones and echoing through their streets, day and night, warning of Russian drones and missiles.
On Sunday night, the system delivered something to make them sit up and take note – a succession of more extreme threats that quickly escalated to impending nuclear strikes, chemical attacks and combat on the streets.
But many in the country did not take them seriously and doubted the veracity of the messages.
Sofia Kochmar, 34, a mother-of-one living in the western city of Lviv, said she was initially concerned but quickly questioned the authenticity of the alerts.
“But then the notification mentioned ‘street fighting in Kyiv’, and I thought, wait, no, that’s impossible.”
The alerts included some messages written in Russian, and one included a link to a Telegram channel apparently owned by a hacker group.
Within 15 minutes, Ukraine’s Air Force issued a statement saying the alert app had been compromised and clarifying there was no radiation threat. But it took more than an hour to issue “all clear” messages.
Anastasiia Romanytska, a 29-year-old ballerina living in Kyiv, said she does not have the alert app installed but friends forwarded her the warnings.
“My first reaction was, ‘Is this some kind of joke?’ But then my body reacted as if I was under stress. My heart started racing, and my stomach tightened up.”
“Still, somehow I immediately realised that it wasn’t something serious. Or maybe I just really wanted to believe that.”
There are a number of apps delivering phone notifications of air raid warnings, with maps showing areas under threat, all using the same data as the official government-backed app.
EPAYevhen Baliutov, a cybersecurity expert at Kyiv School of Economics, told the BBC it was clear to him the Ukrainian alert system was hacked by Russians, saying many Ukrainians had clicked a link included with the alerts leading to a Russian Telegram channel, potentially exposing them to further disinformation, phishing attempts or data breaches.
“This is a war, so it’s no surprise that Russia will try to hack, will try to send us fake news, will try to manipulate, and will use that for their propaganda.”
While both Russia and Ukraine are widely believed to carry out cyberattacks against one another, the informal language used in the hoax alerts on Sunday pointed to so-called hacktivist groups, which could be aligned to Moscow or Kyiv but are not formally directed by either government.
Baliutov said it was also logical that Ukraine would have responded by launching a cyber-attack on the Russian emergency alert system. Both sides have similar capabilities in cyber warfare, he added.
Kochmar said after the initial concern, Ukrainians quickly turned to joking about the incident.
“All our work group chats immediately blew up. Everyone started messaging each other, discussing what was happening. And what I found fascinating was how quickly we turned the whole thing into a joke.”
Although the impact of this incident had been limited, it illustrated the weakness of a crucial system, Baliutov said.
“It’s very dangerous for Ukraine and for our people. When developing such applications, we need to consider security from the very beginning, without skipping essential security measures. When millions of people rely on a service, we cannot afford to take shortcuts with security.”
The authorities already faced the challenge of maintaining public alertness after four and a half years of war with ceaseless attack warnings sounding sometimes hourly. Now they must reassure people the systems in place to protect them are robust, trustworthy and should be followed.
