SII Focus 23rd September 2016

Fancy Bears hack: 107 athletes; 23 countries; 25 sports

A further publication of data illegally obtained from the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) has taken the total number of athletes affected to 107 from 23 countries, competing in 25 sports. The latest publication on the Fancy Bears internet site involves Therapeutic Use Exemptions (TUEs) relating to 41 athletes from 13 countries and 17 sports. It involves seven athletes from both Canada and the US; six from the UK; five from Italy; four from Australia; two from Denmark, Germany, Serbia and Switzerland; and one from Croatia, Japan, South Africa and Sweden.

‘The incident response team that we have assembled is actively working with law enforcement agencies in Canada and elsewhere, and acting on the intelligence obtained through our investigations to prevent any further intrusions’, read a WADA statement. ‘We are also consulting with leading cyber security experts to ensure that no further information is accessed from the broader ADAMS’.

As with the statement issued after last Friday’s hack, today’s statement dropped earlier assertions that a Russian ‘cyber espionage’ group known as Tsar Team (APT28) is behind the attacks. However, a warning statement on the ADAMS website still asserts that Russia is behind the attacks. There is more information on how this group is thought to operate in this Recorded Future post.

As with previous Fancy Bears hacks, there is no evidence that any of the TUEs related to anything other than a genuine medical need. They all involve asthma drugs, ADHD drugs, corticosteroids or anti-inflammatory drugs such as prednisolone. Some appear to involve painkillers used during medical treatment.

As previously stated by WADA, today’s statement reiterated that the activities of the hackers appear to be confined to athletes competing at the Rio 2016 Olympics. While there is no suggestion of any wrongdoing, the apparent widespread use of TUEs at the Rio 2016 Olympics will continue to raise questions as to whether the system needs reform, especially given the apparent gulf between elite and amateur athletes in ease of obtaining a TUE.

WADA recently explained a 48% increase in TUEs between 2014 and 2016 as being the result of a May 2016 WADA Foundation Board decision to ‘reinforce the mandatory requirement’ for all TUEs to be entered into ADAMS, as well as being due to ‘the effect of the Rio 2016 Olympics and Paralympics’. As well as making it impossible to ascertain as to whether there has been an increase in TUEs, this statement raises other questions. If the mandatory requirement to enter TUEs into ADAMS was not being enforced before May 2016, who was monitoring whether TUEs were being correctly granted? Did concern that TUEs were being abused prompt WADA to ‘reinforce’ its requirement that all TUEs are entered into ADAMS?

Reaction

‘In the cases of all four athletes named today, this process determined that their medication use was both necessary for their health and would not give performance enhancing benefits’, read an emailed statement from the Australian Sports Anti-Doping Authority (ASADA) in relation to the four Australian athletes identified through illegally published TUEs. ‘ASADA again condemns the malicious attacks. The leaks are a poor attempt to discredit these athletes and do not show any wrong doing. Certainly, such exemptions do not constitute doping.’

Anti-Doping Denmark (ADD), which as the table above shows has had six athletes affected through their TUEs being published, highlighted that it approved less than half the TUEs applied for during 2015. It said that a total of nine Danish athletes had TUEs at the Rio 2016 Olympics. The largest group of TUEs were for beta-2 agonists for asthma treatment (41); glucocorticoids to treat allergies and inflammation (17) and stimulants to treat Attention Deficit Hyperactivity Disorder (ADHD – 15).

‘In 2015 ADD issued 93 TUEs from 207 applied for’, read a statement. ‘And out of the 93 TUEs, some were sought for treatments that are already permitted under the Prohibited List. Some TUEs were granted for a short period (e.g for inflammation), whilst others can last for up to eight years (for the treatment of chronic illnesses, such as diabetes).’

As previously reported by The Sports Integrity Initiative, the Office of the Privacy Commissioner of Canada is awaiting a response from WADA about whether it had adequate systems in place to protect confidential athlete data. “Under Canada’s Personal Information Protection and Electronic Documents Act [PIPEDA], which applies to WADA, the sensitivity of information is a specific factor to consider in looking at the adequacy of an organisation’s safeguards”, said a spokesperson. As previously reported, ADAMS is due to be replaced at the end of this year.

Follow this story

Read other articles from this story stream...

News 14th September 2016 - 8 days ago

Athletes defend reputations following ADAMS data breach

Athletes have been forced to defend their reputation, after a Russian hacking group illegally published their personal information, claimed that it constituted evidence of doping. As reported by The Sports Integrity Initiative yesterday, the data published comprised adverse analytical findings (AAF) and Therapeutic Use Exemptions (TUE) relating to US athletes, which does not constitute evidence …
Features 15th September 2016 - 7 days ago

Analysis: Further ADAMS leaks targets 25 athletes in 8 countries

The Fancy Bears internet site has exposed adverse analytical findings (AAFs) and Therapeutic Use Exemptions (TUEs) relating to 25 athletes from eight countries, after confidential information from the Anti-Doping Administration and Management System (ADAMS) was published this morning. While the World Anti-Doping Agency (WADA) condemned the leaks as a ‘criminal attack’ that ‘recklessly exposed personal …
News 17th September 2016 - 5 days ago

Additional data leak via Russian cyber hacker Fancy Bear

The World Anti-Doping Agency (WADA) confirms that, once again today, the cyber hacker Group 'Fancy Bear' released a batch of confidential athlete data on their website, which they illegally obtained from a Rio 2016 Olympic Games account of WADA’s Anti-Doping Administration and Management System (ADAMS). This time, they targeted eleven athletes that include three from Australia, one from …
News 19th September 2016 - 3 days ago

Data leak concerning 26 athletes from 10 countries and 12 sports

The World Anti-Doping Agency (WADA) confirms that, again today, the cyber hacker Group 'Fancy Bear' released a batch of confidential athlete data on their website, which they illegally obtained from a Rio 2016 Olympic Games account of WADA’s Anti-Doping Administration and Management System (ADAMS). This time, the group released data concerning 26 athletes from 10 countries, including: …
Features 19th September 2016 - 3 days ago

Fancy Bears hack now involves 66 athletes from 16 countries

A fourth release of confidential athlete data from the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) involves 26 athletes from ten countries and 12 sports. The new release is different from earlier releases in that it doesn’t contain any adverse analytical findings (AAFs), just therapeutic use exemptions (TUEs), which are intended to …
Features 17th September 2016 - 5 days ago

Fancy Bears hack now involves 40 athletes from 10 countries

A new leak of confidential medical data taken from the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) has exposed Therapeutic Use Exemptions (TUEs) and Adverse Analytical Findings (AAFs) relating to 11 athletes from five countries. The data leaked by the Fancy Bears internet site now encompasses the round total of 40 athletes …
Press releases 23rd September 2016 - 30 days ago

Data leak concerning 41 athletes from 13 countries and 17 sports

The World Anti-Doping Agency (WADA) confirms that, again today, the cyber hacker Group “Fancy Bear” released a batch of confidential athlete data on their website, which they illegally obtained from a Rio 2016 Olympic Games account of WADA’s Anti-Doping Administration and Management System (ADAMS). This time, the group released data concerning 41 athletes from 13 countries, including: 4 …
Features 23rd September 2016 - 30 days ago

Fancy Bears hack: 107 athletes; 23 countries; 25 sports

A further publication of data illegally obtained from the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) has taken the total number of athletes affected to 107 from 23 countries, competing in 25 sports. The latest publication on the Fancy Bears internet site involves Therapeutic Use Exemptions (TUEs) relating to 41 athletes from …
News 7th November 2016 - 15 days ago

Fancy Bears targeting NADOs

The cyber criminals known as Fancy Bears, who hacked into the World Anti-Doping Agency’s (WADA) Anti-Doping Administration and Management System (ADAMS) to expose athletes’ private data such as their use of therapeutic use exemptions (TUEs), are now targeting national anti-doping organisations (NADOS). The Canadian Centre for Ethics in Sport (CCES) confirmed that it was forced …
Features 8th December 2016 - 14 days ago

Fancy Bears email hack: USADA did follow up concerns

On Friday 25 November, The Sports Integrity Initiative received an email from Fancy Bears Hack Team claiming to ‘contain examples of sending WADA tests results to unauthorised persons, instability of ADAMS and subjective-based WADA decisions’, as well as evidence of Ultimate Fighting Championship (UFC) competitors taking prohibited substances. The 189 emails came in three archived …
SII Focus 6th July 2017 - 16 days ago

Athletics stars tagged as ‘likely doping’ in IAAF hack

International Association of Athletics Federations (IAAF) emails illegally accessed by Fancy Bears have indicated that some of track & field’s biggest stars were flagged as ‘likely doping’ under the Athlete Biological Passport (ABP) programme. The cache of documentation also includes details of anti-doping cases and criminal proceedings against other athletes; complaints regarding the anti-doping process …
Press releases 7th November 2016 - 15 days ago

CCES Responding to Cyber Attack

If you’ve tried in recent days to send email to someone at the Canadian Centre for Ethics in Sport, you’ll know that our email system is down, along with our Internet access. We shut these systems down after the Canadian Cyber Incident Response Centre detected a cyber attack. The experts tell us that this is likely …
News 6th July 2017 - 16 days ago

IAAF statement - release of information following cyber attack

The IAAF offers its sincerest apologies to the athletes who believed their personal and medical information was secure with us. We will continue to work with cyber incident response (CIR) firm Context Information Security, who identified the Fancy Bear cyber-attack which we announced in April to create a safe environment. Context believes that the information published yesterday …

You may also like...

Pin It on Pinterest

Share This