10 cyberattacks that took place in the sports world!

The Olympic Games, the FIFA World Cup, and the Super Bowl are just a few examples of iconic sporting events that demonstrate the global importance of the professional sports industry.

However, while professional sports evoke passion and emotion among fans, cybercriminals care less about the competitive aspects of sports or the sense of community. Instead, they ruthlessly attempt to exploit the industry's reach and resources to line their pockets with illicit gains.

This striking reality is also reflected in the data. According to a 2020 survey conducted for the UK's National Cyber Security Centre (NCSC), which we also feature here, a staggering 70% of sports organizations have experienced at least one cyber incident or harmful cyber activity. This rate is well above that of general businesses in the UK (32%). Since the European sports industry alone accounts for more than 2% of the continent's GDP, the risks are undeniably high.

As expectations rise for the 2024 Summer Olympics to be held in Paris, let's take a look at 10 cases where sports organizations fell victim to cyberattacks.

1. BEC PLAYBOOK

The aforementioned NCSC report identified Business Email Compromise (BEC) fraud as the biggest threat to sports organizations. To highlight this point, an incident is detailed in which the email account of the general manager of an unnamed Premier League club was compromised during negotiations for a £1 million ($1.3 million USD) player transfer.

A spear-phishing attack lured the victim to a fake Office 365 login page, causing them to unknowingly surrender their login credentials. The criminals then attempted to carry out a BEC fraud worth the aforementioned amount, but fortunately, the bank intervened at the eleventh hour and blocked the scheme.

However, another prominent football club, Italy's Lazio Roma, appeared less fortunate. According to reports in 2018, Lazio was tricked into paying a transfer fee worth $2.5 million into a bank account controlled by scammers.

2. RANSOMWARE

In November 2020, Manchester United fell victim to a ransomware attack that disrupted the club's digital operations. As is common in ransomware attacks, the criminals demanded a ransom payment in exchange for decrypting the data and restoring access to the club's computer systems.

Man U quickly took their systems offline to mitigate damage and prevent the ransomware from spreading further across the network. They also contacted cybersecurity experts and law enforcement to investigate the incident and determine its scope. Eventually, Man U contained the attack and restored their systems without paying the ransom fee.

Speaking of ransomware attacks, the San Francisco 49ers, one of the most popular clubs in the NFL, announced in 2022 that the sensitive information of 20,000 employees and fans had been compromised during a ransomware attack earlier that year. Interestingly, the organization agreed to pay compensation to the victims.

3. OLYMPIC MALWARE

The opening ceremony of the 2018 Winter Olympics held in Pyeongchang, South Korea, was crashed by an unexpected guest: the Olympic Destroyer malware. The malware hit the event's IT infrastructure, disrupting operations during the ceremony and causing chaos for spectators. Among other things, it shut down Wi-Fi hotspots and television broadcasts, preventing spectators from participating in the event.

The attack systematically deleted critical information on affected Windows systems. Furthermore, the malware searched for network locations to spread further and increased the damage on connected devices. In addition, Olympic Destroyer had the capability to install sophisticated software designed to secretly steal passwords.

Attributed to the Sandworm and Fancy Bear APT groups, the attack primarily targeted the event's official website, the servers of ski resorts hosting Olympic competitions, and two IT service providers managing the event's technical infrastructure. Ultimately, this attack sharply highlighted the vulnerability of high-profile sporting events to cyber threats.

4. YOUR MEDICAL HISTORY IS PUBLIC

Olympic Destroyer is not the only case where a cyber-espionage group targeted a prominent international sports organization. In 2016, the World Anti-Doping Agency (WADA) suffered a serious data breach that exposed the medical information of a number of global sports figures.

The incident, whose victims included tennis players Venus and Serena Williams and gymnast Simone Biles, exposed Therapeutic Use Exemptions (TUEs), which allow athletes to use prohibited substances or methods as long as they are prescribed to treat legitimate medical conditions.

WADA attributed the attack to the Fancy Bear group and stated that the breach not only damaged the integrity of WADA's TUE program but also threatened the agency's broader mission to protect the fairness and cleanliness of sports.

5. A BASKET FULL OF DATA

In March 2023, the National Basketball Association (NBA) issued a warning about a data breach that occurred at one of their external mail service providers, resulting in the theft of fans' names and email addresses. Although the NBA's systems were not compromised, this incident underscored the vulnerability of third-party service providers to cyber threats.

In the statement regarding the incident, recipients were advised to be cautious against potential phishing and social engineering attacks that could exploit the stolen information. The NBA assured users that their usernames and passwords were not compromised. Nevertheless, the organization activated its incident response protocols and conducted a comprehensive investigation to further analyze the incident.

Although the NBA's own systems were not breached, the compromise of a third-party newsletter service provider led to people's information being stolen. This breach highlighted the importance of ensuring the security of all components in an institution's ecosystem, as well as the security posture of external service providers. Strengthening cybersecurity measures and establishing robust protocols for monitoring and responding to incidents are essential to reducing the impact of such breaches on organizations and their customers.

6. HOUSTON, WE HAVE A PROBLEM

The iconic phrase "Houston, we have a problem" resurfaced in April 2021 when the Houston Rockets fell victim to a cyberattack at the hands of the gang behind the Babuk ransomware.

This attack had serious consequences for one of the NBA's most prominent teams, and the attackers claimed responsibility for leaking more than 500 GB of confidential information, including sensitive data such as player contracts, customer records, and financial details.

Although the Babuk ransomware is not among the most sophisticated types of ransomware, its impact was significant. The attack continued to pose risks to organizations in other sectors, including healthcare and logistics. Such incidents highlight the indiscriminate nature of cyber threats and the urgent need for robust cybersecurity measures across all sectors.

7. NO ESCAPE

In a basketball game, the end of a quarter is marked by a buzzer. In October 2023, a different kind of buzzer sounded for the French basketball team ASVEL: it signaled a data breach organized by the NoEscape ransomware gang.

The team acknowledged the attack and lamented the exfiltration of 32 GB of sensitive data, including player information such as passports and identification documents, contracts, non-disclosure agreements, and other legal documents.

8. A REAL INCIDENT

All the balance that the Real Sociedad football club showed on the pitch, amidst promising expectations in both the Champions League and the Spanish La Liga, was suddenly disrupted on October 18, 2023, when the club released a short statement announcing that it had fallen victim to a cyberattack.

This incident compromised servers storing sensitive data, including the names, surnames, postal addresses, email addresses, phone numbers, and even bank account details of subscribers and shareholders.

In response, the club advised victims to monitor their accounts for any suspicious activity. They also established an email communication channel for affected individuals to request further assistance or clarification.

9. BOCA IN THE CROSSHAIRS

Club Atlético Boca Juniors, located in Buenos Aires, Argentina, has worldwide recognition. The club's high profile led cybercriminals to target it.

On September 16, 2022, Boca Juniors fell victim to an attack that compromised its official YouTube account. The attackers took control of the channel and began spreading information promoting the Ethereum cryptocurrency, which is actually a fairly typical cryptocurrency scam.

Faced with the breach, Boca Juniors immediately released an official statement on X, assuring its fans and stakeholders that they were acting quickly to regain control over the compromised account. The club successfully restored its online presence within a few hours.

10. AN OWN GOAL?

An attack on the Royal Dutch Football Association (KNVB) in April 2023 resulted in the theft of confidential data belonging to the organization's employees and members. The incident, attributed to the notorious LockBit ransomware gang, was confirmed by the KNVB, an umbrella organization for the country's professional football leagues.

The breach affected various victims, including parents of youth players, international players, professionals from between 2016 and 2018, contacts of the KNVB Sports Medical Center, and individuals involved in the organization's disciplinary matters between 1999 and 2020.

News Source: 12punto