The development team of the Air Alert application apologized to users for the incident on Sunday evening and explained how the attackers managed to send fake notifications. Unauthorized access was gained to the operator’s interface, not the mobile application. The developers also denied information about data leakage and infection of users' phones.
The development team of the Air Alert application apologized to users for the incident on Sunday evening and explained how the attackers managed to send fake notifications. Unauthorized access was gained to the operator’s interface, not the mobile application. The developers also denied information about data leakage and infection of users' phones.
According to the team, "Air Alert" is not just a mobile application, but an entire software ecosystem. It was created by Ajax Systems and Stfalcon on a volunteer basis with the support of the Ministry of Digital Affairs. It includes an operator interface, mobile applications, an alarm map, APIs, and other products and integrations.
The system receives information from civil protection operators or those responsible for notifications in individual communities. The data is then displayed in the application and transmitted via API to other systems. In particular, it is used by air alert maps, shopping mall loudspeakers and street sirens.
On Sunday evening, an unauthorized access to the operator’s interface occurred. As a result, the system received messages about non-existent threats. Users received notifications about fake radiation hazards, chemical attacks, and street fights. They also received custom messages in Russian with a link to a third-party Telegram channel.
The developers are not disclosing details of the incident for security reasons and due to the sensitivity of the topic.
After detecting the problem, the developers, together with relevant services and ministries, suspended the operation of the operator interface and the server part of the application. After checking and eliminating the root causes, the operator interface and the main functions of the application — push notifications about alarms and information about danger levels — were restored within two hours.
The team is currently continuing its security audit and working to restore the display of objectives on the map. The developers note that stable operation of the system remains a top priority, and teams are working to restore it virtually without interruption.
The developers assure that the application installed on the phone does not pose a threat to users. According to them, it does not store or transmit personal data and does not have access to important functions of the smartphone.
The team also denied reports of data leaks, hacking of users' accounts or phones, and the presence of viral files in the application. The developers attribute the spread of such claims to ignorance or attempts to force people to uninstall the application.
For those who have uninstalled Air Alert, the team recommends reinstalling it only through the official App Store or Google Play. Download links are available on the app’s official website .
Finally, the team thanked the services that participated in the response and the users for their patience, trust, and the memes that appeared after the incident.
Recall that on the evening of November 1, users of the official application "Air Alert" began receiving fake notifications about radiation and chemical hazards, as well as street fighting in Kyiv. The Air Force of the Armed Forces of Ukraine stated that the application was likely affected by hostile influence, and assured that there was no radiation threat.
The Air Alert application was developed by Stfalcon in collaboration with Ajax Systems and with the support of the Ministry of Digital Transformation of Ukraine in the first days of the full-scale Russian invasion. The service notifies about air, chemical, man-made and other types of danger in certain regions of Ukraine.
dev.ua contacted Ajax Systems for comment on the situation. The company’s press service assured that the development team is working on strengthening the application’s protection to prevent similar situations in the future, as well as restoring the functionality of displaying targets on the map.
The application is now fully functional.
