Researchers find fake data in Olympic anti-doping, Guccifer 2.0 Clinton dumps

This time, some athlete data was altered by the "Fancy Bear" group.

A pattern of mischaracterization, misrepresentation, and outright alteration of breached data has emerged in two of the latest headline-grabbing batches of hacked files. Investigators discovered that recently published data from anti-doping testing at the 2016 Olympics in Rio de Janeiro had been altered by parties connected to a Russia-based hacking group behind the breach, according to a report issued by the World Anti-Doping Agency (WADA) yesterday.

The International Olympic Committee (IOC) dump, released by a group calling itself "Fancy Bears," was found by WADA's incident response team to contain altered information. "WADA has determined that not all data released by Fancy Bear (in its PDF documents) accurately reflects [Anti-Doping Administration and Management System (ADAMS)] data," a spokesperson for WADA wrote in a post on the investigation. The attackers gained access by stealing ADAMS credentials through "spear phishing" e-mails sent to IOC officials who owned the accounts. The attack was similar to the e-mails sent to DNC and Clinton campaign officials earlier this year.

This fits into a pattern tied to recent hacks by "Fancy Bear" and other groups—organizations that researchers and government authorities believe are connected in some way to the Russian intelligence community—being used for misinformation. Some of the data in the initial Democratic National Committee "dump" by the entity calling themselves Guccifer 2.0 was revealed to have been altered, and that leaked metadata indicated files had been edited by someone who spoke Russian. While the latest "leak" from Guccifer 2.0 allegedly against the Clinton Foundation's network contains no such smoking guns, the metadata does exist and suggest data came from previous "Fancy Bear" breaches at the DNC and other organizations that used the DNC's network.

Forensic examination of the Guccifer 2.0 Clinton files specifically suggests the files came from previous breaches of the DNC and Democratic Congressional Campaign Committee (DCCC). Payroll files, expense reports, receipts, and lease documents for Democratic party field offices—as well as scans of checks issued for payment for FOIA requests and vendors—all point to the DCCC, DNC, and some state Democratic Parties. Files not from the DNC or affiliated organizations came from GMBB (an advertising firm that does work for the Democratic Party), the Federal Election Commission, and the House of Representatives.

Some of the more controversial documents in the collection posted directly on the Guccifer 2.0 WordPress blog, including one titled "Master Spreadsheet PAC Contributions," may have been modified before posting. That file was created and edited once in February 2009. Based on file metadata, it was pulled off the DCCC server on May 23, 2016.