Cyber threat bulletin: The cyber threat to major international sporting events

Key judgements

• We assess cybercriminals will very likely target large organizations associated with major international sporting events and local businesses around the events through business email compromise (BEC) and ransomware attacks for the purpose of extortion. Cybercriminals will also very likely target individuals associated with major international sporting events, including organizers, attendees and spectators, via phishing emails and malicious websites using these events as lures.
• We assess that hacktivists will likely target major international sporting events with tactics such as website defacements, distributed denial-of-service (DDoS) attacks and hack-and-leak operations. These types of incidents can lead to short- to medium-term service interruptions affecting event organizers, officials and participants.
• We assess state-sponsored cyber threat actors will likely engage in cyber espionage against prominent and high-profile individuals attending major international sporting events to collect foreign intelligence or personal information, and to maintain persistent access when targets return to their home countries.
• We assess that state-sponsored threat actors are unlikely to carry out a major disruptive or destructive attack on major international sporting events in the next year.

Hacktivist activity

We assess that hacktivists will likely target major international sporting events with tactics such as website defacements, distributed denial-of-service (DDoS) attacks and hack-and-leak operations. These incidents can lead to short-to medium-term service interruptions affecting event organizers, officials and participants.

Major international sporting events provide an opportunity for hacktivists to widely promote their messaging on domestic issues, environmental causes or international conflict situations. The motivation for hacktivism can vary depending on the event’s location, both with respect to the wider geopolitical landscape and domestic issues in that host nation. For example, the anti-government protests in France regarding controversial changes to the minimum pension age^Footnote7 is likely a motivation for domestic hacktivism against the 2024 Paris Olympics. Internationally, French support for Ukraine has also motivated pro-Russian hacktivist groups to target the French government, including by defacing the websites of the French National Assembly, Children’s Parliament^{Footnote 8} and Senate.^{Footnote 9}

Major international sporting events have been targeted by hacktivists in the past. For example, the 2016 Rio Olympics were targeted by the hacktivist collective “Anonymous”. The group capitalized on the increased global attention to the event to protest the Brazilian government. They used DDoS attacks to take down state websites, including that of the Brazilian Ministry of Sports. They also targeted Brazilian sporting organizations with hack-and-leak operations, including the Brazilian Triathlon Confederation and the Brazilian Confederation of Modern Pentathlon.^{Footnote 10} Similar hacktivist activity occurred during the 2014 World Cup where Anonymous carried out DDoS attacks on other state websites, like that of the Brazilian Intelligence Agency and the Ministry of Justice, and on some of the event’s sponsors, like The Emirates Group and Hyundai.^{Footnote 11}

State-sponsored cyber espionage

We assess state-sponsored cyber threat actors will likely engage in cyber espionage against prominent and high-profile individuals attending major international sporting events to collect foreign intelligence or personal information, and to maintain persistent access when targets return to their home countries. Canadians considered to be high-profile attendees include:

• government officials
• heads of delegations
• heads of sporting organizations with connections to the government
• representatives of partnered private organizations
• anti-doping program officials

We assess state-sponsored cyber threat actors will likely engage in cyber espionage against high-profile organizations to collect sensitive personal and business information. These high-profile organizations could include government organizations, partnered private organizations and anti-doping organizations.

Sporting organizations have been targeted by state-sponsored cyber threat actors for espionage in the past. During the 2016 Rio Olympics, Russia-backed threat actors targeted the Wi-Fi networks and routers of a hotel chain used by Olympics officials during the event for reconnaissance. They conducted operations both remotely and on-site, travelling to Rio de Janeiro to gain and maintain persistent access to the networks. While at a hotel in Rio, an International Olympic Committee (IOC) official logged into the World Anti-Doping Agency (WADA) database. Their credentials were then stolen by the threat actors and used, along with other credentials, to export large amounts of information from the database.^{Footnote 12}

These Russia-backed cyber threat actors compromised WADA’s systems with the intention to diminish public trust in the organization by exfiltrating and leaking sensitive information. They leaked the personal information of 127 athletes, including their test reports, therapeutic use exemptions (TUEs) and past infractions.^Footnote16 The compromise disclosed personal information, undermined public trust in WADA and affected Canadian athletes, including four members of Canada’s women’s soccer team.^{Footnote 17}

The attack on WADA was almost certainly in retaliation for the organization’s support and publishing of “The McLaren Report”, an independent report that alleged that the Russian Ministry of Sport had engaged in a coordinated doping scheme. WADA recommended that Russia be banned from the Olympics following the release of this report. Attempts to compromise WADA began shortly after.^{Footnote 18}

Russian athletes are still banned from participating in the Olympics under their country’s banner, meaning there is still motive to conduct cyber espionage operations.^{Footnote 19} However, it is unlikely that Russian actors will specifically target high-value Canadians linked to major international sporting events for cyber espionage campaigns or hack-and-leak operations.

State-sponsored disruptive or destructive cyber attacks

The Cyber Centre is not currently aware of specific intent by state-sponsored cyber threat actors to target major international sporting events in the next year. We assess it is unlikely that a state-sponsored threat actor will carry out a major disruptive or destructive attack on any major international sporting event in the next year. Despite this, it’s important to note that major international sporting events and their associated organizations have been targeted by state-sponsored threat actors in the past. Contributing factors include:

• the cultural and political landscape
• foreign policy
• the opportunity to promote an agenda on the global stage
• a desire for retaliation against the host country

The Russian national team was again banned from the 2018 PyeongChang Olympic games for state-sponsored doping, and some athletes participated under the Russian Olympic Committee (ROC) banner instead. In retaliation to that ban, Russian cyber threat actors hacked Olympic infrastructure during the opening ceremony to disrupt the flow of the proceedings.^{Footnote 22} The attack took down the official Olympic Games website as well as Wi-Fi in the stadium. By disrupting event services,^{Footnote 23} the attackers intended to negatively affect the reputations of the IOC and South Korea.

Russian athletes are currently banned from several international sporting federations following Russia’s invasion of Ukraine, including the:

• Fédération Internationale de Football Association
• Union of European Football Associations
• International Ice Hockey Federation
• IOC^{Footnote 24}

In October 2023, the IOC officially suspended the ROC after they decided to claim regional sports organizations in occupied areas of Ukraine, which is a violation of the Olympic Charter.^{Footnote 25} While Russian athletes will still be able to participate, they must do so as neutral athletes, not under their country’s banner.^{Footnote 26}

Due to current geopolitical tensions, there is a roughly even chance that major international sporting events are targets for Russian state-sponsored cyber disruption.

Outlook

The high profile and costly nature of major international sporting events make them a prime target for cybercriminals looking to exploit targets of opportunity for profit. They also provide a global stage for hacktivists and state-sponsored actors to gather information and publicly embarrass a target. Although events differ in their size, popularity and host nation, the types of threats they face are consistent across events. Thus, we assess that the threat to major international sporting events is likely to remain consistent with our assessments and unlikely to change over the next year.

Many cyber threats can be mitigated through awareness and best practices in cyber security. The Cyber Centre encourages all attendees, athletes, government officials and organizations associated with major international sporting events to take appropriate measures to protect their systems against the cyber threats detailed in this assessment.

Please refer to the following online resources for more information and for useful advice and guidance.

• National Cyber Threat Assessment 2023-2024
• Baseline cyber threat assessment: Cybercrime
• Protecting your information and data when using applications – ITSAP.40.200
• Mobile device guidance for high profile travellers – ITSAP.00.088
• Don’t take the bait: Recognize and avoid phishing attacks – ITSAP.00.101