Compromise of the World Anti-Doping Agency
Date of report
  • September 2016
  • Believed to be the work of APT 28
The World Anti-Doping Agency (WADA) confirmed in September 2016 that it had been compromised by suspected Russian threat actors in a data leak of confidential information about forty-one athletes who competed in the Rio Olympic Games. The data revealed drug-test results and medical data pertaining to “therapeutic use exemptions,” situations in which WADA allows athletes to take banned substances if their usage is deemed legitimate. A group using the Fancy Bear moniker, the same term some security experts assign to a Russian state-sponsored threat actor, claimed responsibility for the compromise. Some commentators viewed the incident as Russian retaliation for a WADA report that detailed Moscow-sanctioned efforts to provide performance-enhancing drugs to Russian athletes during the 2014 Sochi Winter Olympics. The United States, Australia, Canada, New Zealand, and the United Kingdom issued statements attributing the incident to Russian military intelligence. Separately, the United States issued an indictment against seven alleged Russian military intelligence officials involved in the incident.
Suspected victims
  • World Anti-Doping Agency
Suspected state sponsor
  • Russian Federation
Type of incident
  • Espionage
Target category
  • Civil society
Victim government reaction
  • Yes
Policy response
Suspected state sponsor response