Fancy Bears hackers are back and this time, their target was The International Association of Athletics Federations (IAAF). Apparently, the hackers have managed to get away with the athletes’ medical records, including therapeutic use exemption (TUE).
This breach was reported to the athletics’ world governing body, and even though they admitted that unauthorized access was made, they stated that they’re unsure if any information was stolen from the network.
Sebastian Coe, the IAAF president, has stated that the first priority of the organization is the athletes who trusted the IAAF with this confident information. He apologized for the incident and promised that everything in the organization’s power will be done in order to recreate as safe environment as possible.
It is believed that the hack was done by the Fancy Bears. This group is believed to be from Russia, even though the Russian officials have denied any links with the group. They became largely infamous in the last few years after several hacking attacks, including those EFF spoof, French television attack, Ukrainian artillery, Democratic National Committee, and the most famous hack of WADA last August, when several high-profile athletes including American tennis star Serena Williams, a four gold medals winning gymnast Simone Biles, and also British cyclists Chris Froome and Sir Bradley Wiggins had their medical records stolen and leaked online.
However, the IAAF attack was discovered by British security company called Context Information Security. They were contacted by the IAAF with a request to conduct an investigation of its systems, which is how they managed to discover a “sophisticated intrusion”.
Thomas Fischer, security advocate and threat researcher at Digital Guardian commented on the issue and said that:
“We’re once again reminded that threat actors will target both the public and private sector, and everyone, even global sporting bodies, can be vulnerable to these style of attacks. This style of attack reminds us that “data aware” technologies are key in helping to prevent sensitive data from being copied, moved or deleted without approval or permission. This means that, even if a sophisticated hacker manages to breach the network, they are prevented from removing, altering or destroying key information without the required permissions. Cyber groups like Fancy Bear have an arsenal of tools at their disposal to break down the doors of a network, but that doesn’t mean they should be able to walk out with the crown jewels under their arm. Keeping data safe doesn’t take a huge investment, it just takes a smart one. Let’s hope this is the final reminder to governing bodies of the importance of protecting data.”
Eduard Meelhuysen, Head of EMEA at Bitglass commented that:
“With little more than a year until the GDPR, it is more important than ever for organizations to implement appropriate measures to keep personal data safe. Fast forward to May 2018 and this breach could well have landed the IAAF with a hefty fine if it was found to have neglected its security responsibilities. At the very least, sensitive data should be protected with encryption and watermarking – both fairly straightforward technologies that are readily available. Organizations should also consider how they can use the public cloud for data storage in place of on-premises infrastructure. After all, the major cloud providers such as Microsoft have committed to spending billions of dollars on security personnel and infrastructure, and that’s a lot larger than the security budget available to the average sporting body.”
In its statement, the company said that “We have received the full support of the IAAF during the subsequent Cyber Incident Response engagement and, throughout the investigation, the IAAF have understood the importance and impact of the attack and have provided us comprehensive assistance. This has been critical in allowing us to both quickly identify the nature of the intrusion and to provide a full and diligent resolution.”
DDoS attacks are increasing, calculate the cost and probability of a DDoS attack on your business with this DDoS Downtime Cost Calculator.
