Suspected Russian hack of Kyiv Independent spread fake nuclear attack alert
Hackers accessed The Kyiv Independent's website management system and newsletter distributor, sending false emails, including one claiming President Zelensky launched a nuclear warhead at Kyiv. The outlet attributed the attack to suspected Russian actors based on message content, without technical evidence, and is investigating with specialists. Banking data of members and donors was not compromised, according to the publication.
What happened
Hackers breached The Kyiv Independent's website management system and newsletter service; the outlet has nearly 3 million monthly readers in 2025. Using the compromised channels, they published false messages and emailed subscribers, including one claiming Zelensky launched a nuclear warhead at Kyiv. The outlet attributes the attack to suspected Russian actors, without technical evidence.
Why it matters
Hacked official channels spread mass disinformation and panic and erode brand trust, as Editor-in-Chief Olga Rudenko acknowledged. Direct financial exposure was contained: banking data of its more than 35,000 paying members was not compromised because payments run through secure third-party services, according to the publication.
What to do
Audit who can access publishing and email systems, enforce multifactor authentication and rotate credentials. Monitor for unusual posts and sends, and prepare a rapid-response plan for false messages.
For the technical team
- Affected
- The Kyiv Independent, um dos principais veículos de notícias em inglês da Ucrânia; site interrompido por ciberataque · The Kyiv Independent: website and newsletter distribution service.
- Exploitation
- Attack executed and confirmed by the outlet itself; attribution to suspected Russian actors based on message content, with no technical evidence linking the breach to Moscow (The Kyiv Independent, via The Record).
- Fix
- No product fix. Staff are working with cybersecurity specialists to investigate the breach, identify vulnerabilities and prevent further intrusions, according to COO Zakhar Protsiuk.
- Vector
- Breach of the outlet's website management system and newsletter distribution service; the entry vector was not disclosed in the sources.
- More details
- One fake email in Russian urged recipients to seek shelter and included the username of an anonymous Telegram channel; other emails fabricated claims of a physical attack on Zelensky. False messages were also posted on the website and quickly removed by staff. It is the first attack of this kind at the outlet, founded in November 2021. Days earlier, hackers compromised Ukraine's air raid alert app with false warnings about nuclear and chemical threats, tied to a group calling itself Hitcore Corp; there is no confirmed connection between the two incidents.
Timeline
Incident opened.
