The World Anti-Doping Agency has confirmed a “Russian cyber espionage group” illegally gained access to its confidential medical database.
The Russian hackers, known collectively as “Fancy Bear” or “Tsar Team,” published private medical records of four Team USA stars: Olympic gold medalist and gymnast Simone Biles, tennis giants Serena and Venus Williams and basketball MVP Elena Delle Donne.
“WADA deeply regrets this situation and is very conscious of the threat that it represents to athletes whose confidential information has been divulged through this criminal act,” WADA director General Olivier Niggli said in a statement.
The leak reportedly showed that the athletes were authorized to take prescriptions that were on the list of WADA’s banned substances. Olympic athletes can receive “Therapeutic Use Exemptions” (TUEs) to take substances that might normally be banned, if they are proven to treat certain medical conditions.
“After detailed studying of the hacked WADA databases we figured out that dozens of American athletes had tested positive,” the Fancy Bears’ group said on its website. “The U.S. team played well but not fair.”
For Biles, the hackers published data that showed the gymnast tested positive for d-amphetamine and dexmethylphenidate, which are used to treat attention deficit hyperactivity disorder (ADHD).
USA Gymnastics released a statement today, saying Biles “filed the proper paperwork” for an exemption. As reported by USA Today, the International Olympic Committee condemned the attack, adding that these four athletes didn’t violate anti-doping rules.
WADA officials said the Russian hackers gained access to the athletes’ medical records with a spearphishing attack, which uses targeted emails or phone calls to trick someone into giving out important information.
This breach comes months after WADA released a report exposing a state-sponsored doping program in Russia. Except for one athlete based in the U.S., the country’s track and field team was banned from this year’s Rio Games.
The group said it will disclose more leaked data on other Olympic teams later. Experts believed the same group of Russian hackers breached WADA’s website in August.