The world of athletics woke up on Monday to shocking news of a cyber-attack on International Association of Athletics Federations (IAAF) that has breached athletes’ medical records stored in the global track and field governing body’s servers in Monaco.

The IAAF subsequently issued a statement on Monday confirming that the attack was orchestrated by notorious Russian international hackers Fancy Bear, also known as APT28, who have been notorious for carrying out cyber attacks with their list of victims including the World Anti-Doping Agency (Wada).

Fancy Bear have also been accused of disrupting political elections in several countries, including Germany and USA.

Subsequently, IAAF President Seb Coe has apologised for the intrusion and pledged to get to the bottom of the matter.

Monday’s attack, according to the IAAF, seems to have compromised athletes’ Therapeutic Use Exemption (TUE) applications stored on IAAF servers.

TUE refers to express permission given to athletes to take specific medications to treat illnesses or conditions while such medications may appear on Wada’s list of banned performance enhancing substances.

Among top sports stars on TUE are tennis star Serena Williams and British cycling stars Chris Froome and Brad Wiggins.

In athletics, Britain’s distance running star Mo Farah is also a beneficiary of TUE.

Fancy Bear have previously questioned the morality of TUE with the debate reaching a deafening crescendo with Russia’s current ban from international athletics over allegations of state-sponsored doping.

Russian track and field athletes were barred from last year’s Olympics in Rio and the ban also holds for the IAAF World Championships in London in August.

“The IAAF has been a victim of a cyber-attack which it believes has compromised athletes’ Therapeutic Use Exemption (TUE) applications stored on IAAF servers,” Monday’s statement from the IAAF said.

“The attack by FANCY BEAR, also known as APT28, was detected during a proactive investigation carried out by cyber incident response (CIR) firm Context Information Security, who were contacted by IAAF at the beginning of January to undertake a technical investigation across IAAF systems.

“The presence of unauthorized remote access to the IAAF network by the attackers was noted on 21 February where meta data on athlete TUEs was collected from a file server and stored in a newly created file.

“It is not known if this information was subsequently stolen from the network, but it does give a strong indication of the attackers’ interest and intent, and shows they had access and means to obtain content from this file at will.”

The IAAF said they, over the last one month, consulted the UK National Cyber Security Centre (NCSC) and the Agence Monégasque de Sécurité Numérique (Monaco AMSN) “and worked with Context to carry out a complex remediation across all systems and servers in order to remove the attackers’ access to the network.”