Katie Williams
Live reporter

Ukraine and Russia both say their emergency alert apps were hit by cyber-attacks on Sunday night, with residents in Ukraine receiving warnings of air raids, radiation, a chemical threat and street fighting.

Ukraine's air force said the app had "likely been compromised by the enemy".

Russia subsequently said a "massive cyber-attack" had affected its app too, giving attackers the ability to "distribute false information to the public".

A Kyiv resident told the BBC her first reaction on seeing warnings in Ukraine was: "Oh my god, I'm not prepared for this", while another resident in Lviv said she felt "nervous and scared" after seeing the word "nuclear".

But Ukrainian MP Oleksandr Merezhko says Ukrainians have "unfortunately" become used to constant alerts and tend to treat all information "with a certain scepticism".

Merezhko added that he could neither confirm nor deny whether Ukraine was behind the reported cyber-attack on Russia.

There's still a lot we don't know about the alerts sent out in Russia, including whether the two incidents are connected. It's possible the near simultaneous attacks were retaliatory tit-for-tat - our cyber correspondent has more on that.

Meanwhile, both sides have continued to exchange strikes.

We're ending our live coverage but you can read more in our story.

Officials need to understand how over 100 fake alerts were issued across Ukrainepublished at 12:21 GMT

12:21 GMT

Dan Johnson
Ukraine correspondent, reporting from Kyiv

Millions of Ukrainians received these warnings on their phones late last night, via the official Air Alert app and others which are fed by the same data.

122 fake alerts were issued across the country between 22:47 and 22:54 Kyiv time, most warning of incoming missiles or drones but some stating the threat included radiation, chemical attack, artillery shelling and fighting in the streets of the capital.

Warnings of such extreme danger will have unnerved many people, but the fact so many alerts came in quick succession indicated a potential technical issue, and widespread panic appears to have been avoided.

The air force issued a statement at 23:02 saying the app had been compromised and reassured citizens there was no radiation threat.

Lots of Ukrainians have stopped using the alert apps or taking action in response to notifications because there are so many warnings of genuine Russian attacks - sometimes up to 20 in a day.

Officials are keen to emphasise that only the system issuing alerts was affected, and Ukraine’s air defences have not been compromised.

Still, they’ll need to understand how this happened so they can ensure the system is secure and alerts can be relied on in future.

Anastassia Levchenko
Reporting from Kyiv

A woman in the Ukrainian city of Lviv, Sophia, says the first thing she saw was the word "nuclear" when the false alerts came through last night, which made her "pretty nervous and scared".

"My first thought was that something nuclear was actually flying toward us," she says, recalling how the app "suddenly started screaming at me in the middle of the night".

The main reason she has the app is to know when there's an air raid alert at her child's school, she says. "Our school doesn’t have a shelter, so whenever there’s an alert, I have to go and pick her up."

She says she didn't spot the Russian text, skipping "right past that". But when the notification mentioned street fighting in Kyiv, she became suspicious.

"I thought, wait, no, that’s impossible... we don’t start fighting each other in the streets when ballistic missiles are flying over our heads," she says.

Experts say possible tit-for-tat hacks show the murky nature of cyber warpublished at 11:48 GMT

11:48 GMT

Joe Tidy
Cyber correspondent

One attack on an air raid warning system is serious but an immediate strike back on another is not just serious, but also strange.

The order of attacks seems to be Ukraine was hit first then Russia was attacked within a few hours. This has not yet been confirmed.

Cyber experts say it is highly unlikely that a hacking group could carry out a retaliatory hack so fast without already having the power to do it.

This means that the group hacking out of revenge (likely to be Ukrainian-supporting hackers) had been sitting on the ability to do this for some time and was waiting.

The hacks have the hallmarks of hacktivists - activist hackers.

But one cyber expert who specialises in hacktivists says that this could be a false flag.

"Traditionally hacktivists burn access pretty fast," he says.

So the idea of the second attack coming from an amateur group of Ukrainian hackers seems unlikely.

"My suspicion is Ukraine or Ukraine government-aligned hackers sat on their Russian access because it is civilian adjacent and maybe they had rules of engagement that discouraged an attack like that until Russian hackers did what they did," he says.

Ukrainian MP Oleksandr Merezhko says he can neither confirm nor deny if Ukraine was behind the reported cyber attack on Russia.

Image source, Reuters

Jack Grey
Live reporter

A cyber attack on the Ukrainian emergency alert system could indicate "desperation" from Russia, according to cyber security expert Don Smith.

Russia has not claimed responsibility for the attack, while Ukraine has blamed the incident - which saw false warnings of nuclear attack sent to its citizens - on Russian interference, our correspondent in Kyiv reports.

Smith, of cyber security firm Sophos, says the attack could have been aimed at impacting the "mental resilience of the people of Ukraine", which he says is key factor of Ukraine's ability to defend itself against Russia.

However, he says the "best information warfare" is not obvious or explicit, while this attack on Ukraine "very clearly is", which "could indicate desperation from Russia".

He adds that it is possible an individual account with access to the Ukrainian alert system was compromised, rather than the core system itself.

Steve Rosenberg
Russia editor

Image source, EPA/ Shutterstock

Without referring specifically to the hack of the emergency ministry app, President Vladimir Putin’s press secretary Dmitry Peskov has spoken in general of the threat of cyberattacks on Russian government resources.

"One way or another, all electronic resources of our government departments are under constant threat from cyberattack," Mr Peskov said on his daily conference call with journalists.

"The website of the Russian President suffers multiple cyberattacks every day. Other departments, too. As technology - including artificial intelligence – develops, the threat from cyberattacks grows. This obliges all departments to take measures to better protect our digital resources."

According to Russia’s emergency ministry, the hack of its mobile application did not affect Russia’s "public alert system" – in other words, no false messages were carried over loudspeakers, TV and radio channels. No sirens were activated.

The app hack produced what the ministry calls "dissemination of fake information to the public".

Screenshots of such messages, shared on social media, warn of nuclear warheads launched at Russia.

But the text of the messages contains obscenities: a clear sign to anyone receiving them that they weren’t genuine.

Ukraine false alerts show hallmarks of hacktivistspublished at 10:55 GMT

10:55 GMT

Joe Tidy
Cyber correspondent

Amid the messages that popped up on Ukrainian phones over night was one that contained a link to a newly-created Telegram channel.

The channel appears to be run by an anti-Ukrainian group which has quickly gained 15,600 subscribers and a huge amount of activity with hundreds of thousands of views of posts.

The channel posted a screenshot of the alert with a derogatory caption.

The hackers behind the channel also posted propaganda saying that Ukraine is "losing decisively, and you know it".

The alerts themselves were also strangely flippant and not the kind of thing you imagine to be sanctioned by a professional cyber military unit.

""Hi! A nuclear alert is about to go off all across Ukraine! Don't worry, the Oreshnik is on its way."

Image source, Reuters

Oreshnik is the name of a Russian intermediate-range ballistic missile capable of carrying nuclear or conventional warheads.

The alerts that landed on Russian phones were also written in a colloquial way with swear words.

It has all the hallmarks of a hacktivism - activist hackers. Dozens of hacktivist groups have emerged on both sides since the full-scale invasion and often use loud and attention grabbing hacks to make political points.

They also relish the attention. One post to the Telegram group says: "Greetings to the SBU, the Armed Forces of Ukraine, and everyone else who is reading this channel."

Although hacktivists are meant to be separate from official state run hacking teams, some groups have been seen to work closely with Ukrainian or Russian militaries.

Nick Beake
Europe correspondent, reporting from Brussels

Image source, EPA

British Defence Secretary Wes Streeting says the UK does not yet know who is behind the reported cyber-attack on the Ukrainian emergency alert system but is monitoring the situation closely.

Streeting is in Brussels this morning, meeting the EU's foreign policy chief, Kaja Kallas. I asked them both how concerned they were that alerts were sent out in Ukraine saying there was fighting on the streets of Kyiv and a radiation threat.

Streeting replied: "We don't yet know who is behind this particular cyber-attack in Ukraine. We'll follow those developments closely, but what we're in no doubt about is that right across Europe, we have seen these hybrid or state-sponsored terrorist attacks driven by Moscow, so we'll watch this one very closely.”

Ms Kallas says cyber-attacks are part of the broader warfare Russia is conducting against Ukraine.

“What the Russians are trying to do is really to hurt the civilians as much as possible so that the alerts wouldn’t work, so that they would have as many people killed as possible," she says.

"July, August, and September have been the deadliest months for Ukrainians during this whole war, and this is because Russia has not been able to move on the battlefield, so they are causing as much damage to the civilians to really pressure them into submission."

We can now bring you more on the strikes that were reported overnight.

An oil pipeline transport system in the village of Prosvet, in Russia's south-western Samara region, was reportedly targeted by overnight strikes.

Breaking news Astra Telegram channel said dark smoke could be seen rising "from the direction of" the Samara oil refinery.

Astra quotes the regional governor, Vyacheslav Fedorishchev, who reportedly blamed Ukraine for the attack.

The channel reports that the facility was attacked several times in October.

The authorities have not officially confirmed any attack on the facility, although a Telegram channel run by the Samara regional administration said on 1 October that air defences were "repelling enemy drones" over the region.

Image source, Social media via Reuters

Image source, SPRAVDI

Russia

Russia's emergency ministry announced the hack on its app just hours after Ukraine's alert system was hit. It’s not clear if the two incidents are connected.

In a post on Telegram, it said the mobile application had been hit by a "massive cyberattack", giving attackers the ability to "distribute false information to the public". It said work was under way to "eliminate the vulnerability" and restore normal operation.

Around 90 minutes later, it issued another statement saying that the compromised app "has not affected - and cannot affect - the functioning of the public alert system".

It said the "primary" channels for alerts were sirens and loudspeakers, SMS messages and television and radio broadcasts. The app "serves merely as an additional, supplementary information service", it added.

Ukraine

Ukraine's air force issued an update on Telegram after the apparent attack saying: "The 'Air Alert' app has likely been compromised by the enemy. There is no radiation threat!"

Ukraine's emergency service later posted on Telegram, urging people to pay attention to alerts broadcast via loudspeakers and not to click on links from unknown sources. "The national warning system is operating normally," it said.

Image source, Ukraine Parliament

Ukrainian MP Oleksandr Merezhko says he can neither confirm nor deny if Ukraine was behind a reported cyber attack on Russia, which occurred shortly after a cyber attack on Ukraine.

Merezhko says Ukraine believes Russia was likely behind the cyber attack on Ukraine's emergency warning system, as the warnings were issued in Russian, as opposed to Ukrainian.

However, he says there is "no official confirmation, as of yet at least" that Ukraine was responsible for a cyber-attack on Russia's emergency app.

"In such cases we don't confirm or don't deny," adds Merezhko, who is also head of the foreign affairs committee in the Ukrainian Parliament.

On the reaction to the fake alerts, he says Ukrainians have "unfortunately" become used to constant alerts, to the point where people "tend to treat all kind of information with a certain scepticism".

"Luckily in this case there was swift action from the air force, saying that it was a fake alert," he adds.

Near simultaneous hacks could be retaliatory tit-for-tatpublished at 08:49 GMT

08:49 GMT

Joe Tidy
Cyber correspondent

It is very strange to see both sides being hit in near simultaneous cyber attacks on two similar but entirely separate alert systems.

I reached out to a contact in the Ukrainian hacktivist community who said that it suggests that Ukraine hacked Russia’s alert system as part of a retaliation.

“Most likely this was a retaliatory hack” the hacker said.

The contact says that hacking alert systems is a tactic that, until now, had "not been used due to moral and ethical considerations".

Social media reports show that the Ukrainian app Trivoha was hacked first and then Russia’s equivalent was hit shortly after.

On a popular Ukrainian Telegram group about air raids, the messages show discussions about the hack of Trivoha followed by screenshots of Russia’s alert system showing the hack message to Russians.

The poster on the group of 20,000 celebrated the apparent strike back saying “haha, quickly”.

It is not clear, though, which alert system was hit first.

If this is confirmed as a tit-for-tat scenario, it implies that whoever struck second had the power to carry out the hack but chose to hold off until its own system was hit.

There has been no official response though and no groups have yet claimed responsibility.

Katie Williams
Live reporter

Image source, AFP via Getty Images

Ukraine and Russia both say their emergency warning apps have been hit by cyber-attacks overnight. Here's the latest:

In Ukraine

False red-level air raid alerts started at approximately 22:47 local time (20:47 GMT) on Sunday.

Kyiv was hit by additional false warnings for radiation, chemical attacks and street fighting - here's a timeline.

Ukrainian politician Oleksander Merezhko says the fact a message was in Russian "immediately aroused suspicions", calling hacking "part of cyber war".

In Russia

A few hours later, Russia said its app had been hacked in a "massive cyber-attack" with hackers "able to distribute false information to the public".

The false alert warned app users there was a "risk of getting lively", and said nuclear warheads had been launched "at all regions of Russia".

Russia's emergency ministry called the app "an additional, ancillary news service" and says its public alert system is "operating as normal".

It is unclear if the two incidents are connected, our correspondent in Kyiv reports.

We can now bring you some reaction to the apparent cyber-attacks from a resident in Kyiv, who tells the BBC of her shock after receiving false emergency alerts warning of radiation and the threat of nuclear attack.

"The first thought was 'Oh my god, I'm not prepared for this'," Olena tells Radio 4's Today programme.

"I'm prepared for blackouts, for a cut in central heating and water supply, but not for nuclear attack," she adds.

Olena says her husband then received alerts for "street fighting attacks in Kyiv" and another alert, written in Russian.

"After that I understood that somebody had attacked the app, because all notifications we get in Ukrainian."

Image source, Reuters

Four people have been injured in air strikes on Ukraine's Zaporizhzhia region, according to co-chair of the regional defence council Ivan Fedorov.

No immediate update is given on their condition.

Sharing the update on Telegram, Fedorov adds that there were also 43 reports of damage to homes, vehicles, and infrastructure in the region.

Separately, Ukraine's armed forces says hits from air strikes were recorded at 26 locations across the country overnight, with debris falling at another nine locations.

It says 154 Russian drones were intercepted by air defences.

While we wait for further information on the apparent cyber attacks in Russia and Ukraine, here's the latest on the strikes that were reported overnight.

In a statement on Telegram, Russia's Ministry of Defence says it struck a Ukrainian military cargo vessel at sea 58km south of Odesa overnight.

It says the vessel was "delivering cargo intended for the Ukrainian Armed Forces".

Another strike hit a storage site for Ukrainian missile launch systems in the Odesa village of Tuzly, it says.

Meanwhile, a Telegram channel for the city of Odesa says four people were injured in strikes in Odesa overnight. "All received prompt medical assistance," the update says.

It adds that two private homes, a garage and city infrastructure also sustained "significant damage".

Image source, Reuters

The false alerts started at approximately 22:47 (20:47 GMT) on Sunday, with red-level air raids apparently issued nationwide, in Ukrainian.

Additional warnings were issued in Kyiv, with the first reading: "Radiation threat. Radiation threat declared in Kyiv."

The next message, written in Russian, came at 22:48, which read: "Hi! There will be a nuclear alert across Ukraine. Don't worry, it's Oreshnik flying". Oreshnik is the name of a Russian intermediate-range ballistic missile capable of carrying nuclear or conventional warheads.

A third alert, at 22:49, again in Ukrainian, said "Chemical threat. There is a threat of a chemical attack on Kyiv. Don't go outside."

At 22:49, a fourth alert stated there was a "street fighting threat. Street fighting is taking place in Kyiv. Don't go outside."

At 23:53 a series of all clear messages were then delivered to users' phones, which were connected to each of the previous Kyivalerts, individually declaring each threat clear.

We don't know much about the alerts sent out in Russia. But as we reported earlier, a Ukrainian espionage group claimed fake warnings of nuclear strikes inside Russiahad been sent to users.

Dan Johnson
Ukraine correspondent, reporting from Kyiv

Ukraine’s air raid alert app usually warns of incoming Russian drones or missiles.

Last night it issued alerts of a radiological threat, a chemical attack and street fighting here in Kyiv.

The warnings were followed by all clear messages just over an hour later.

The air force issued a statement saying the app had been hacked and reassured citizens there was no imminent threat of nuclear war, blaming Russian interference.

Hours later, Russia’s emergencies ministry claimed it had also suffered a cyber attack and said people were receiving emails containing fake information.

It’s not clear if the two incidents are connected.

Oleksander Merezhko, chair of the Ukrainian parliament's foreign affairs committee, has told the BBC the attack did not cause panic or extreme reactions.

Merezhko says Ukrainians, especially in Kyiv, are used to "practically non-stop alerts".

"Secondly, this message was in Russian language which immediately aroused suspicions," he says.

"It's a very unpleasant fact but it is part of cyber war and people in Ukraine understand that. It is possible and we are quite prepared for such possibilities," adds Merezhko, a member of President Volodymyr Zelensky's Servant of the People party,

Image source, Getty Images

Russia and Ukraine both say their emergency alert systems have been hit by cyber-attacks. Here's what we know so far:

• The attacks caused the two systems to send fake emergency alerts
• Ukraine‘s air raid app sent false red-level air raid warnings nationwide, with additional warnings of radiation, chemical attacks, and street fighting sent to some residents including in Kyiv.
• Ukraine cancelled the alerts within an hour and clarifications were issued by authorities.
• A few hours later Russia said its alert app was also attacked, but said that it was only an “ancillary” service among sirens and other warnings.
• It was not clear how wide the false alerts had been distributed in Russia. A Ukrainian espionage group claimed fake warnings of nuclear strikes inside Russiahad been sent to users.
• The false alerts occurred just minutes before the end of a localised ceasefire in Ukraine's frontline Kherson region, which was implemented last Tuesday and officially ended at 23:00 Sunday