Hackers linked to the Russian government have posted online what they say are the Olympic drug-testing files of four U.S. athletes, including Serena Williams and gymnastics champion Simone Biles.
The World Anti-Doping Agency confirmed Tuesday that a cyber-espionage group known as Fancy Bear illegally hacked its database of Olympic athletes for the 2016 Rio games, but had no comment on whether the files posted were authentic. NBC News has not confirmed that the files are authentic or, if authentic, are unaltered.
NBC News reported details of the suspected hack of WADA files Aug. 27, saying it was part of the same covert influence campaign by the Putin regime to target numerous U.S. government, political organizations and other perceived enemies and potentially disrupt the November election. U.S. officials have linked Fancy Bear to GRU, the Russian military intelligence agency.
Russian athletes were banned from the Rio Olympics — and Paralympics — after WADA’s recommendation to ban them due to evidence of widespread doping.
In a detailed statement Tuesday, WADA confirmed a broad cyber-penetration of its Anti-doping Administration and Management System, known as the ADAMS database. It also said law enforcement authorities had traced the breach to hackers “originating out of Russia” known as Tsar Team (APT28), “also known as Fancy Bear,” and that they had illegally gained access via an International Olympic Committee (IOC)-created account.
The hackers posted statements online claiming that they were going public with information about the U.S. athletes to show the U.S. won a large number of medals at the Olympics through cheating.
A post on the website Fancybear.net said the group was “shocked with what we saw” and that a review of hacked WADA files showed “that dozens of American athletes had tested positive” for banned substances, in cases in which they had been given official approval to use them due to extenuating circumstances.
“We are going to tell you how Olympic medals are won,” it warned. “We will start with the U.S. team which has disgraced its name by tainted victories. We will also disclose exclusive information about other national Olympic teams later.”
The website alleges that the U.S. athletes “got their licenses for doping …This is other evidence that WADA and IOC’s Medical and Scientific Department are corrupt and deceitful.”
The website said Biles, who won four gold medals in Rio, tested positive sometime in August 2016 after methylphenidate “was detected in her sample.” The drug is sold under various trade names, including Ritalin, and commonly used to treat ADHD.
The site also alleged Serena Williams had taken painkillers and anti-inflammatories. NBC News does not have confirmation that the claim is accurate.
The site also posted what it said were files from Venus Williams and basketball player Elena Delle Donne.
Representatives of the athletes could not be immediately reached, but Simone Biles responded to the hack via Twitter.
“I have ADHD and have taken medicine for it since I was a kid. Please know, I believe in clean sport, have always followed the rules, and will continue to do so as fair play is critical to sport and is very important to me.”
Elena Delle Donne also responded to the hack via Twitter: “I’d like to thank the hackers for making the world aware that I legally take a prescription for a condition I’ve been diagnosed with, which WADA granted me an exemption for. Thanks, guys!”
The purported files for Williams and Biles, for example, showed that the athletes had been granted exemptions for “therapeutic use,” which is permitted under Olympic rules.
Tygart stopped short of saying the files were authentic.
In a statement, WADA Director General Olivier Niggli said the international organization “condemns these ongoing cyber-attacks that are being carried out in an attempt to undermine WADA and the global anti-doping system. … WADA deeply regrets this situation and is very conscious of the threat that it represents to athletes whose confidential information has been divulged through this criminal act.”
Added Niggli: “These criminal acts are greatly compromising the effort by the global anti-doping community to re-establish trust in Russia further to the outcomes of the Agency’s independent McLaren Investigation Report.”
A spokeswoman for WADA told NBC News that the anti-doping agency would have no further comment at this time.
Niggli said WADA was taking the hacks extremely seriously, cooperating with all relevant law enforcement agencies and doing internal and external security vulnerability checks. And, he said, “We are reaching out to stakeholders, such as the [International Olympic Committee and participating countries] regarding the specific athletes impacted.”
While many key details were unavailable, the alleged posting of athlete information gained through the cyberintrusions appears to go beyond an incident in mid-August, when details about the hack of Russian athlete and whistleblower Yuliya Stepanova’s ADAMS account was disclosed. As in Stepanova’s case, WADA believes hackers illegally gained access to private accounts through “spearphishing” efforts to gained access to their passwords.
Initially, WADA said hackers never breached ADAMS or the accounts of other athletes besides Stepanova. In its Aug. 27 report, NBC News said personal information purporting to be from many other athletes had started mysteriously popping up online in mid-August.
U.S. security officials blame Fancy Bear for cyber-attacks on various Democratic Party organizations including the Democratic National Committee, as well as some accounts at the White House, State Department and the military’s Joint Chiefs of Staff.
Russian officials have denied playing any role in the various hacks attributed to Fancy Bear and another hacking organization known as Cozy Bear that is believed to be sponsored by a separate Russian intelligence organization.