Cyberattack on the "Air Raid Alert" App: Ajax Systems and Stfalcon Reveal Details of the Breach

The Ajax Systems and Stfalcon teams described the circumstances surrounding the cyberattack on the “Air Raid Alert” app’s notification system. The attackers managed to gain access to the on-duty operator’s workstation and send out false danger alerts. At the same time, the personal data of millions of users remained secure.

In their official statement, the development team explained in detail the causes of the outage that occurred on Sunday. The experts emphasized that the unknown attackers gained unauthorized access exclusively to the operator’s control panel, not to the mobile app on users’ smartphones.

Taking advantage of the breach, the attackers sent out false alerts about fabricated chemical and radiation threats and street fighting, and also included a third-party link to a Russian-language Telegram channel.

The developers explained that the “Air Raid Alert” platform is not merely a service for transmitting information from third-party databases, but a complex volunteer-driven ecosystem. It was created by Ajax Systems and Stfalcon with the support of Ukraine’s Ministry of Digital Transformation.

The system integrates a dispatcher interface, mobile apps, APIs, and siren infrastructure.

Upon detecting the cyberattack, engineers, in collaboration with relevant ministries and special services, promptly shut down the servers and the operator’s control panel. At the same time, key services and push notifications were restored within two hours.

Separately, the developers denied reports of a possible leak of personal data. Speculation had been circulating online that hackers might have obtained information about the location of every smartphone on which the app is installed.

However, the team emphasized that the app does not technically collect, store, or transmit users’ personal data. Furthermore, it does not have access to the smartphone’s confidential functions.

The developers called reports of allegedly virus-infected files or compromised accounts a deliberate manipulation. According to them, the goal is to force Ukrainians to delete the “Air Raid Alert” app.

Currently, engineers are conducting an in-depth security audit of the system and configuring the display of targets on the threat map.

In an official statement, the service’s development team provided a detailed explanation of the causes of Sunday’s outage.

The “Air Raid Alert” app partially resumed operations following a cyberattack that occurred on the evening of Sunday, November 1. At the same time, users’ personal data remained secure, and no data leaks were detected.

As a reminder, Ukraine’s nationwide alert system is operating without disruptions.

Prior to this, the Air Alert app in Kyiv had sent out a false radiation warning.

Following this, the Air Force announced a possible breach of the alert app.