False Alert: It happened in Ukraine and in Russia, could Israel be next? - analysis

After more than four years of war, many Ukrainians have become accustomed to sirens and alerts on their phones warning of imminent attack. Despite this, the barrage of messages late Sunday night - 122 alerts in less than ten minutes - left many unnerved.

The alerts on Ukraine’s official Air Alert app warned off incoming radiation, chemical and even nuclear attacks. Less than 15 minutes after the communications began Ukraine’s air force warned citizens that the Air Alert app had been compromised and false information disseminated.

An incident of this nature likely would have caught the attention of security analysts around the world, even before similar false messages started being pushed on Russian alert apps, just a few hours later.

Both nations’ public alert systems being breached within hours of each other is doubly focusing minds, and will be garnering attention across the world, not least in Israel where so much of the population are reliant on similar alert apps.

At the time of writing the party, or parties, behind the cyber attacks on the two alert systems remains unclear. Some commentators have pointed to the use of Russian and (badly spelt) English in the push notifications sent out to Ukrainians to suggest that private individuals rather than the Russian state were more likely behind the cyber attack on Ukraine.

A Russian Telegram channel identified the pro-Russian hacker group Hitcore as responsible, though this has not been verified. But the interface between a state’s security services and hacker groups who indirectly support that state ideologically is extremely opaque.

If Hitcore was indeed behind the breach, did they operate on their own initiative, or following orders from handlers who report to the Kremlin?

Coming several hours after the breach on the Ukrainian app, the false messages sent out across the Russian Emergency Situations Ministry app appear likely to be a retaliation operation.

Due to the speed with which this occurred it is likely that the Russian alert system was already compromised, and that the exploit was held in reserve and only triggered after it became clear Ukraine’s system was under attack. This implicates the Ukrainian security services or a hacker group sympathetic to Ukraine as being responsible.

In Israel usage of alert apps is so widespread that the applications, the notification sounds they make, and a whole lexicon around their use has become part of everyday life.

During the last round of intense missile launches from Iran in the spring, Israelis’ social media feeds were flooded with content creators riffing on the apps, usually through comedy. In the months after October 7th, 2023, millions of Israelis downloaded alert apps, either the official Home Front Command program, or applications providing similar services, like Tzofar.

Over time citizens often become accustomed to using the apps, adding incoming missiles to the list of challenges to juggle among the other tasks in everyday life. “I’ve just had a pre-alert warning… should I take the food out of the oven now? Or wait until after we get back from the siren?” But this familiarity with risk can become complacency.

During the period of March–June 2025, when the Houthis were regularly firing ballistic missiles at Israel that were almost always intercepted, Israelis became so confident in their air defenses that many people began ignoring the alerts and sirens: “It’s only the Houthis.” Such is the prevalence of air raids occurring in Ukraine’s Kyiv that similar alertness fatigue is reportedly setting in.

Ukraine and Russia clearly view each other as the main threat actors when it comes to cyber attacks upon their public alert systems, but for Israel the most obvious threat in this regard is Iran. Not only does the Islamic Republic have the resources of a state to invest in long term cyber operations, but it has engaged in multiple bouts of long ranged exchanges of fire with Israel.

But as Israel grows more isolated diplomatically and its standing in global public opinion continues to degrade, it is possible that additional actors may increasingly become a cyber threat to Jerusalem. Hacktivists may have been involved in the Ukraine and Russian case, and this type of actor could threaten Israel’s public alert system. This could be hacktivists aligned with a state like Iran, or simply a group hostile to Israel and its policies.

A major part of preparing for this threat is in the technological arena: maintaining and securing the digital platforms that citizens have grown accustomed to relying upon. Israel’s cyber and general technological acumen will likely mean it does relatively well in this regard. But as Israel has learned to its cost, it does not pay to be complacent.