Nuclear warnings lit up phones in Kyiv and Moscow. Neither government sent them.

Start with what the two governments agree on, because they agree on the core of it. Ukraine's Air Force says the Air Alert application — the official air-raid warning app, built by Ajax Systems with the Ministry of Digital Transformation and used by 6.6 million people as of January, per The Record — was subjected to hostile interference on Sunday night, November 1. Russia's Ministry of Emergency Situations says its own mobile app suffered what it called a “massive cyberattack” in the early hours of Monday, November 2. Neither statement is contested by the other side. Everything beyond that shared core — who did it, how, and whether the two breaches are connected — is claim and counter-claim, and this story keeps the two piles separate.

The Ukrainian sequence is timestamped in the BBC's reconstruction. The first alert reached Air Alert users at about 10:47 p.m. Kyiv time on Sunday: a radiation threat declared in Kyiv. At 10:48 p.m. came a message in Russian saying a nuclear alert would cover all of Ukraine — in Cybernews's translation: “There will be a nuclear threat across Ukraine. Do not worry, the Oreshnik is incoming.” Oreshnik is a Russian intermediate-range ballistic missile. Two more alerts followed at 10:49 p.m., in Ukrainian: a chemical attack on Kyiv, and street fighting, telling people not to go outside. Warnings also appeared for Kharkiv and Zaporizhzhia. Cybernews counted 122 unauthorized alerts in roughly seven minutes, written in Russian, English and Ukrainian.

Fifteen minutes after the first alert, the Air Force answered on its own Telegram channel — the post quoted on this story's receipt card: “The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” Air Force spokesman Yuriy Ihnat confirmed to AFP that the app had been hacked. The app's team then said, in a statement carried by Ukrinform and Ukrainska Pravda: “Third parties carried out unauthorised interference in the application's work. We have disabled push notifications and temporarily suspended the application.” The app was restored on Monday.

One part of the night reached beyond the phones. Ukraine's intelligence agency said the compromised app had caused a radiation hazard signal to be played over loudspeakers in the western Lviv region, and repeated that no radiation hazard existed. The boundary around it is documented too: the State Emergency Service of Ukraine said the nationwide warning system was operating normally — in its summary, the incident affected the app, not the operation of the national warning system. Both facts stand at once: a loudspeaker signal in one region was triggered by the breach, and the state system behind it was, by the emergency service's account, never compromised.

Kyiv's side also produced a blame claim, and SmokeScreen prints it as one. SPRAVDI, Ukraine's Center for Strategic Communications, posted on X that Russia was behind the breach, publishing no evidence with the post; the claim has not been independently confirmed. A previously unknown group calling itself Hitcore Corp — a name referenced inside the hijacked messages — claimed responsibility, saying, per The Record's reporting, that it had reached the app by sending a phishing file to an administrator's computer. NBC News said it could not verify the group's claim.

Hours later — at about 2:45 a.m. Moscow time on Monday — the second app spoke. The Russian Emergencies Ministry's app and its regional channels carried a message preserved in screenshots published by The Insider and quoted by Cybernews: “Don't worry! NUCLEAR WARHEADS ON P1-SUN DELIVERY SYSTEMS have been launched across ALL regions of Russia.” The message went on, in profane terms, to order readers to stock up on food for three weeks and hide in their basements. The ministry said the false information reached users in 33 regions. The profanity is itself part of the text evidence — it does not read like a message the ministry writes.

The ministry's statement, as carried by the BBC, said the app had been hit by a “massive cyberattack” resulting in the “dissemination of fake information to the public.” The ministry took the app's services offline, removed the messages, and said it would be fully restored by the end of Monday. It drew the same boundary Kyiv drew. The app, the ministry stressed, is “an additional, supplementary information service” — and per The Record's account of its statement, the hack had not affected, and could not affect, the main warning network of sirens, loudspeakers, texts and broadcasts.

Moscow's side produced competing claims rather than one. A group identifying itself as DC8044, an independent Kyiv-based cybersecurity community, said it carried out the breach through the app's programming interface, according to The Record. The pro-Ukrainian partisan movement Atesh also posted a screenshot of the alert on Telegram; the BBC said it could not verify Atesh's post. Russian officials named no one — they blamed “malicious actors.”

The Russian message carries its own check, and it needs no government statement. The P1-SUN exists. It is a Ukrainian interceptor drone built by the defense firm SkyFall to destroy Russian Shahed-type attack drones by ramming them. Defense Express's published specifications for the original model give it an operational range of 15 to 23 kilometres and a warhead of about 800 grams. That is the whole check: a drone that flies about twenty kilometres carrying less than a kilogram of explosive cannot be the delivery system for nuclear warheads “launched across ALL regions” of the largest country on earth. Whoever wrote the message named a real weapon whose published numbers contradict the message — a detail any reader can check against the spec sheet in the receipts.

Which leaves the question the symmetry invites: one operation, a retaliation, or coincidence? On the published record, the honest inventory is short. The two incidents sit hours apart and mirror each other in method — a trusted alert app, a nuclear message, an official correction within the hour. Against that: no government has published evidence connecting them, and no confirmed entry point or vulnerability has been disclosed for either breach. Cybernews's assessment is that it is “far from obvious that the trick was organized by the same groups or people.” The BBC's cyber correspondent Joe Tidy reported a source in Ukraine's hacktivist community suggesting the pair could be tit-for-tat retaliation — a suggestion from one unnamed source, printed here as exactly that.

So the record, sorted. Documented: two official alert apps breached in one night, November 1–2, 2026 — confirmed in writing by both governments; the message texts and their timestamps; an official correction within fifteen minutes in Kyiv and within hours in Moscow; one loudspeaker spillover in Lviv region; the state warning systems behind both apps reported intact by the services that run them; and a named weapon in the Russian text whose published specifications contradict the text. Claimed, without published evidence: Russia's responsibility for the Kyiv breach, Hitcore Corp's account of how it got in, DC8044's claim to the Moscow breach, Atesh's screenshot, and the tit-for-tat theory. Unknown: who sent either set of messages, how either system was entered, and whether they were connected. The receipts are below. Read the receipts. Decide for yourself.