Russian hackers have leaked the confidential medical information of some of the United States’ top Olympic stars in what is being regarded as a revenge cyber attack for the country’s partial ban from the Rio Games. They are also threatening to expose athletes from other nations.
The hacking group, which security experts believe is linked to Russian intelligence services, broke into the World Anti-Doping Agency’s (Wada) administration database and posted on its website documents revealing medications used by four prominent American athletes.
Star gymnast Simone Biles, who won four gold medals in Rio, tennis players Serena and Venus Williams, and basketball player Elena Delle Donne were all victims of the leak. The American athletes’ use of the substances were revealed by urine tests that flagged up “adverse analytical findings” but were covered by therapeutic use exemptions (TUEs), which allow sportspeople to take medications without failing a doping test.
Wada said that the hacking group, operating under the name of Tsar Team and also known as Fancy Bear, had accessed the database by using an account created by the International Olympic Committee (IOC) for the Rio 2016 Games.
There is some concern that members of the Great Britain Olympic team may have their medications revealed by the hackers, given that the president of the IAAF, Lord Coe, is also the British Olympic Association chairman. The IAAF took the toughest stance of any sport against Russia, banning the track and field team from international competition in June because of state-sponsored doping.
The Williams sisters’ TUEs included prednisolone, which is used to treat soft-tissue injuries and reduce inflammation, while Biles had one for Ritalin, to treat attention deficit hyperactive disorder (ADHD).
Her condition was not widely known, but after the leak she tweeted: “I have ADHD and I have taken medicine for it since I was a kid. Please know, I believe in clean sport, have always followed the rules, and will continue to do so as fair play is critical to sport and is very important to me.”
Venus Williams expressed her anger at the hack. “I was disappointed to learn today that my private, medical data has been compromised by hackers and published without my permission,” she said in a statement last night. “The exemptions posted in the hacked report are reviewed by an anonymous, independent group of doctors, and approved for legitimate medical reasons. I am one of the strongest supporters of maintaining the highest level of integrity in competitive sport.”
Richard Ings, the former head of the Australian anti-doping agency, said that the medications being used were not any cause for concern.
“This is normal stuff to cover illness and injury, it’s standard,” he said. “I see nothing alarming in the data so far.”
In July, the Fancy Bear group was held responsible for hacks on the Democratic Party’s National Committee in the US. After its latest action, the group posted a statement on its website saying: “We will start with the US team which has disgraced its name by tainted victories. We will also disclose exclusive information about other national Olympic teams. Wait for sensational proof of famous athletes taking doping substances any time soon.”
Wada responded with alarm and has implemented additional security. The agency believes that a password from the IOC account was obtained by “spear phishing”, where users are tricked into revealing the access details.
A Wada source said: “We believe that this is a revenge attack from Russia after the Wada commission reports into Russia doping. We will now need to monitor all our stakeholders to see who is accessing what. We know these Russians have been trying to do it for a number of weeks.”
The latest breach of Wada’s cyber- defences comes after the agency confirmed last month that Russian whistleblower Yuliya Stepanova’s file had been accessed by hackers.
Stepanova, who is living in hiding in the US after revealing the scale of doping in Russian sport, later said that she feared for her life after the hack.
Wada’s director general Olivier Niggli said in a statement: “Wada deeply regrets this situation and is very conscious of the threat that it represents to athletes whose confidential information has been divulged through this criminal act.
“Wada condemns these cyber-attacks that are being carried out in an attempt to undermine Wada and the global anti-doping system.”
Wada had wanted a total ban for Russia from Rio after revelations of a system that covered up hundreds of positive tests. State officials were involved in swapping samples for clean urine at the Sochi Winter Olympics in 2014 through a hole in the laboratory wall. The IOC also attacked the latest hacking, stating that none of the athletes named in the files was guilty of doping. “The IOC strongly condemns such methods, which clearly aim at tarnishing the reputation of clean athletes,” it said. “The IOC can confirm, however, that the athletes mentioned did not violate any anti-doping rules during the Olympic Games Rio 2016.”
The US Anti-Doping Agency called the move “cowardly and despicable”. Chief executive Travis Tygart said: “It’s unthinkable that in the Olympic movement, hackers would illegally obtain confidential medical information in an attempt to smear athletes to make it look as if they have done something wrong.
“The athletes haven’t. In fact in each of the situations the athlete has done everything right in adhering to the global rules for obtaining permission to use a needed medication.”