Russian hackers broke into a World Anti-Doping Agency database and posted confidential medical data of prominent American athletes online.
WADA said Tuesday the attack — which targeted some female members of the United States team that competed at the Rio de Janeiro Olympics — was carried out by a “Russian cyber espionage group” called Fancy Bears.
The hackers revealed records of “Therapeutic Use Exemptions,” which allow athletes to use substances that are banned if there is a verified medical need.
The group’s website said it had information about a number of American athletes, including tennis sisters Serena and Venus Williams as well as multiple gold medal-winning gymnast Simone Biles and basketball star Elena Delle Donne.
“We will start with the U.S. team which has disgraced its name by tainted victories,” the group said, adding that more revelations about other teams were forthcoming.
Speaking on behalf of the Williams sisters, the International Tennis Federation said the players had been given permission to use the drugs.
Venus Williams wrote in a statement: “The applications for TUEs under the Tennis Anti-Doping Program require a strict process for approval which I have adhered to when serious medical conditions have occurred. The exemptions posted in the hacked report are reviewed by an anonymous, independent group of doctors, and approved for legitimate group of doctors.”
USA Gymnastics said in a statement that Biles, who won four gold medals in Rio, obtained the proper permission to take prescription medicine on the WADA banned list. Biles wrote on Twitter she takes medication for ADHD.
“By virtue of the TUE, Biles has not broken any drug-testing regulations, including at the Olympic Games in Rio,” the organization said. “Simone and everyone at USA Gymnastics believe in the importance of a level playing field for all athletes.”
The breach was decried as an illegal invasion of privacy and an attempt to discredit anti-doping authorities.
“These criminal acts are greatly compromising the effort by the global anti-doping community to re-establish trust in Russia,” World Anti-Doping Agency director general Olivier Niggli said in a statement.
WADA said it “extended its investigation with the relevant law enforcement authorities.”
WADA previously warned of cyberattacks after its investigators published reports into Russian state-sponsored doping.
Russian news agencies quoted Kremlin spokesman Dmitry Peskov as saying any possible Russian government or secret service participation in the hacking was “out of question.”
Last month, hackers obtained a database password for Russian runner Yuliya Stepanova, a whistleblower and key witness for the WADA investigations. She and her husband, a former official with the Russian national anti-doping agency, are now living at an undisclosed location in north America.
The International Olympic Committee said it “strongly condemns such methods which clearly aim at tarnishing the reputation of clean athletes.”
“The IOC can confirm however that the athletes mentioned did not violate any anti-doping rules during the Olympic Games Rio 2016,” the Olympic body said.
Niggli said: “WADA deeply regrets this situation and is very conscious of the threat that it represents to athletes whose confidential information has been divulged through this criminal act. We are reaching out to stakeholders … regarding the specific athletes impacted.”
Those behind the breach have adopted the name “Fancy Bears,” an apparently tongue-in-cheek reference to a collection of hackers which many security researchers have long associated with Russia.
In a statement posted to its website early Tuesday, the group proclaimed its allegiance to Anonymous, the loose-knit movement of online mischief-makers, and said it hacked WADA to show the world “how Olympic medals are won.”
Internet records suggest Fancy Bears’ data dump has been in the works for at least two weeks; their website was registered on Sept. 1 and their Twitter account was created on Sept. 6. Messages left with the group were not immediately returned.
With AP and Reuters