Russian hackers — possibly the same group that compromised the Democratic National Committee’s computer servers — have made top American athletes their latest target.
Joining an intercontinental dispute over sports doping, the hackers penetrated the World Anti-Doping Agency’s athlete database and publicly revealed private medical information about three of the United States’ most famous athletes: Serena Williams, Venus Williams and Simone Biles.
The hackers published documents this week showing that Ms. Biles, who won four gold medals in gymnastics at the Rio Olympics last month, and the Williams sisters received medical exemptions to use banned drugs.
The antidoping agency confirmed the authenticity of the documents in astatement Tuesday, attributing the hack to Fancy Bear, a Russian cyberespionage group that forensics specialists have tied to breaches against government agencies, nonprofit organizations and corporations. That group is believed to be associated with G.R.U., the Russian military intelligence agency suspected of involvement in the recent theft of emails and documents from the D.N.C.
“These criminal acts are greatly compromising the effort by the global antidoping community to re-establish trust in Russia,” WADA’s director general, Olivier Niggli, said Tuesday, referring to revelations of elaborate government-ordered doping by Russia that prompted more than 100 of the country’s athletes to be barred from the Rio Games.
The hackers wrote on their website that the United States had “played well but not fair” in Rio de Janeiro, and the medical documents were hailed in Russia on Tuesday as evidence of both widespread doping among American athletes and the double standards of global antidoping regulators.
Dmitry Peskov, spokesman for President Vladimir V. Putin, said that the Kremlin was not involved in the hacks. “It’s simply ruled out,” Mr. Peskov said.
Russia has gone to to great lengths to maintain plausible deniability in matters of espionage. The Kremlin often delegates high-profile political attacks to third parties, such as in the case of a 2007 attack on Estonia, according to one classified American intelligence estimate.
On their website, the hackers claimed to be both members of Anonymous, the global hacking collective, and Fancy Bear, which typically works in extreme stealth and takes great measures to cover its tracks. Those two groups have not been aligned before.
Revenge, apparently, motivated the WADA hacks. In May, The New York Times reported the account of Russia’s longtime antidoping lab chief, who said the country had run a doping program and staged an elaborate cheating scheme at the 2014 Sochi Olympics. A subsequent report commissioned by WADA confirmed that account.
The United States Anti-Doping Agency said that the American athletes in question had sought the requisite approvals to take typically prohibited substances, and that none of the positive drug tests constituted a violation.
The drugs mentioned in the documents are commonly prescribed medications that treat ailments including pain and allergies. The Times is not identifying the drugs for privacy reasons.
Ms. Biles acknowledged on Tuesday that she was prescribed medication for attention-deficit hyperactivity disorder. “Having ADHD, and taking medicine for it is nothing to be ashamed of, nothing that I’m afraid to let people know,” she wrote on Twitter.
Athletes with particular medical conditions may apply for special permission to take banned substances, requiring a doctor’s diagnosis and the approval of sports authorities. The WADA list of prohibited drugs — including a range of substances, from cannabis to attention-deficit disorder drugs to anabolic steroids — is updated each year.
In 2016, meldonium — a heart medication that improves blood flow — was added to that list, resulting in infractions for several Russian athletes, including the tennis star Maria Sharapova. (Ms. Sharapova, who said she was unaware the drug had been banned, was barred from competition for two years. She appealed that decision at an arbitration hearing in New York this month, and awaits a verdict in October.)
The records published by the hackers showed that at the Rio Games, Ms. Biles tested positive for a prohibited substance used to treat A.D.H.D. that she had received permission to take.
U.S.A. Gymnastics officials said Ms. Biles’s drug use had been approved. “Simone has filed the proper paperwork,” said Steve Penny, the organization’s president. “Simone and everyone at U.S.A. Gymnastics believe in the importance of a level playing field for all athletes.”
The International Tennis Federation confirmed on Tuesday that it, too, had approved exceptions for Serena and Venus Williams to take banned substances in recent years.
“In each of the situations, the athlete has done everything right in adhering to the global rules for obtaining permission to use a needed medication,” said Travis T. Tygart, Usada’s president. “It’s unthinkable that in the Olympic movement, hackers would illegally obtain confidential medical information in an attempt to smear athletes to make it look as if they have done something wrong.”
WADA said its management system was infiltrated through the so-called “spearphishing” of email accounts, in which attackers send tailored emails to authorized users to convince them to click on malicious links or attachments that give attackers a toehold onto their machines. The agency said the attackers used that unauthorized access to gain entry through an International Olympic Committee account that was set up for the Rio Games.
Law enforcement authorities determined that the attacks originated in Russia, WADA said.
This week’s hack came in the wake of revelations about the hacking of the WADA account of the Russian whistle-blower Yuliya Stepanova, a middle-distance runner who fled the country and is now living in an undisclosed location in the United States. That account contained her whereabouts.
Ms. Stepanova said last month that she feared for her safety, and that she and her husband — a former employee of Russia’s antidoping agency who has also spoken publicly about the country’s systematic doping — had moved to a new address as a result.
The hackers said Tuesday that they planned to release the medical records of additional athletes from around the world in coming days.
“This is just the tip of the iceberg,” a statement posted to the Fancy Bears site said. “Today’s sport is truly contaminated while the world is unaware of the large number of American doping athletes.”-NYTIMES