The Need for Digital Defense: Cyber Threats to Sports Organizations

Photo Source: Richard Patterson, Cyber Security Red, Flickr (Jun. 7, 2018) (CC BY 2.0)

By Justin W. Bogle*                                              Posted: 04/12/2021

As demonstrated in the last year, technology has become enmeshed with people’s daily lives to a previously unthinkable degree.[1]  Unfortunately, this tight bond has enabled an explosion of cyber-attacks at every level of society.[2]  As a recent report by the British government’s National Cyber Security Centre (NCSC) makes abundantly clear, the world of sports has not escaped this dangerous trend.[3]  While the phrase “cyber-attacks” appears monolithic, there are many different, but related, types of cyber threats an organization can face.[4]  Bad actors have utilized these techniques to attack sports groups around the world, often in search of financial or personal information.[5]  Thankfully, sports organizations can mitigate these risks, so long as they follow relatively simple step to protect themselves.[6]

“Cyber-Attacks” Broken Down

While there are a number of ways to mount cyber-attacks, the NCSC recently identified three main types that have been used against sports organizations: Business Email Compromise (BEC), cyber-enabled fraud, and ransomware.[7]  BEC, which according the NCSC is the largest threat, is the practice of attempting to obtain fraudulent access to email and other accounts.[8]  Bad actors attempt to gain access to senior level employees’ email accounts through techniques such as “spear phishing” or sending emails, text messages, and other messages to trick employees into giving up confidential information.[9]  These attacks facilitate fraudulent access, often so bad actors can access financial data.[10]  Recently, this practice has grown easier, as more organizations move to software-as-a-service (SaaS) options, such as Office 365, that allows access to multiple platforms with one sign-on.[11]  The second major type of cyber-attack is cyber fraud, where attackers attempt to trick users into utilizing fake websites or responding to fraudulent emails to gain access to confidential systems.[12]  Finally, the third primary method of attack identified by the NCSC comes from ransomware.[13]  Unlike the earlier two types of cyber-attacks, where bad actors are seeking to gain access to systems unnoticed, ransomware attacks lock out rightful users from their systems until the bad actors are paid, hence the name.[14]  The unfortunate reality is that about 70% of British sports organizations have experienced at least one of these kinds of cyber-attacks.[15]

A Bruising Series of Hits

Unfortunately for the sporting world, there have been a series of cyber-attacks at different levels over the past few years.[16]  In early 2016, the Milwaukee Bucks announced that they had been the subject of a cyber-attack.[17]  A team staffer received what he thought was an email from the team president and sent along sensitive employee financial information, including names, addresses, and social security numbers.[18]  Furthermore, in the summer of the same year, a Russian-backed hacker group known as “Fancy Bear” attacked the World Anti-Doping Agency (WADA).[19]  The group managed to gain access to WADA’s systems through a spear phishing attack and leaked athletes’ personal information onto the internet.[20]   In 2020, the popular British football team Manchester United was the victim of a cyber-attack.[21]  While the team has not provided clear details on exactly what happened, they were reportedly locked out of their internal systems, potentially due to a ransomware attack.[22] This is not a one-time issue, or something that can be ignored, but rather an ongoing threat that the sports world needs to adjust to.[23]

How to Play Defense

While this threat is real and serious, organizations are not without tools to better protect themselves.[24]  A simple, but key, measure would be to institute multi-factor authentication (MFA) for login credentials.[25]  MFA is the practice of requiring a user to enter secondary information after their password, such as a randomly generated code, before they can access their account.[26]  Such extra steps may be burdensome on the average user but can protect otherwise vulnerable systems from common attacks.[27]  To protect against cyber-enabled fraud, the NCSC recommends both training employees to spot and avoid suspicious emails and utilizing more technical methods to make it more difficult for suspicious emails to be sent or received.[28]  To defend against ransomware, organizations will need to utilize more technical resources.[29]  Updated security software, regular system backups, and segregated systems are necessary to make sure that any potential damage is as limited as possible.[30]  Ultimately, this threat is unlikely to subside, so the best strategy for athletic organizations to overcome potential threats in this digital age is a strong defense.

*Staff Writer, Jeffrey S. Moorad Sports Law Journal, J.D. Candidate, May 2022, Villanova University Charles Widger School of L

[1] See Chuck Brooks, Alarming Cybersecurity Stats: What You Need To Know For 2021, Forbes (Mar. 2, 2021) https://www.forbes.com/sites/chuckbrooks/2021/03/02/alarming-cybersecurity-stats-------what-you-need-to-know-for-2021/?sh=3684729558d3 (noting steep rise in cyberattacks partially due to increased technological integration).

[2] See id. (referencing various cybercrime victims including governments, corporations, and regular people).

[3] See The Cyber Threat to Sports Organisations, Nat’l Cyber Security Centre,  https://www.ncsc.gov.uk/files/Cyber-threat-to-sports-organisations.pdf (last visited Mar. 23, 2021) (highlighting cyber vulnerabilities in world of sports).

[4] See Jon Bartley, et al., Cyber Threats To Sports Organisations (And Key Steps To Reduce Exposure), Law in Sport (Oct. 8, 2020) https://www.lawinsport.com/topics/item/cyber-threats-to-sports-organisations-and-key-steps-to-reduce-exposure (detailing various common cyberthreats).

[5] See generally Sean Lyngaas¸ Manchester United attack illuminates the cyberthreats facing an overlooked sports sector, Cyber Scoop (Dec. 1, 2020) https://www.cyberscoop.com/manchester-united-hack-ransom-cyberattack/ (explaining recent cyber security breach at Manchester United); Steve Ragan, Milwaukee Bucks hit by W-2 Phishing attack, csoonline.com (May 23, 2016) https://www.csoonline.com/article/3073458/milwaukee-bucks-hit-by-w-2-phishing-attack.html (explaining cyber-attack on Milwaukee Bucks); The World Anti-Doping Agency (WADA) Confirms Attack By Russian Cyber Espionage Group, Law in Sport (Sept. 13, 2016) (hereinafter WADA Confirms), https://www.lawinsport.com/topics/news/item/wada-confirms-attack-by-russian-cyber-espionage-group (describing Russian cyber-attack on World Anti-Doping Agency).

[6] See Matt McLaughlin, Sports Face Off Against Cybersecurity Threats, Biztech Magazine (Nov. 8, 2018) https://biztechmagazine.com/article/2018/11/sports-face-against-cybersecurity-threats (suggesting how sports organizations can better protect themselves).

[7] See Clare O’Gara, What Is the Cyber Threat to Sports?, Secure World (July 24, 2020), https://www.secureworldexpo.com/industry-news/cyber-threat-to-sports (listing major cyberattack types).

[8] See The Cyber Threat to Sports Organisations, supra note 3, at 11 (explaining how organizations can be compromised through BEC).

[9] See Nena Giandomenico, What is Spear-phishing? Defining and Differentiating Spear-phishing from Phishing, Data Insider (Dec. 1, 2020), https://digitalguardian.com/blog/what-is-spear-phishing-defining-and-differentiating-spear-phishing-and-phishing (defining spear-phising).

[10] See id. (explaining reasoning and purpose of BEC attacks);

[11] See The Cyber Threat to Sports Organisations, supra note 3, at 11 (explaining new dangers from BEC attacks).

[12] See id. at 14 (defining cyber fraud and providing examples).

[13] See id. at 17 (explaining ransomware).

[14] See id. (defining ransomware practices).

[15] See id. at 8 (contextualizing scale of problem).

[16] See McLaughlin, supra note 6 (listing variety of different cyber-attacks).

[17] See Ragan, supra note 5 (explaining cyberattack against team).

[18] See id. (describing how team was breached).

[19] See WADA Confirms, supra note 5 (blaming Russia for recent cyber-attack).

[20] See id. (describing effects of attack).

[21] See Tara Seals, Manchester United: IT Systems Disrupted in Cyberattack, Threat Post (Nov. 23, 2020), https://threatpost.com/manchester-united-disrupted-cyberattack/161488/ (noting breach).

[22] See id. (explaining details of attack).

[23] See The Cyber Threat to Sports Organisations, supra note 3, at 8 (noting widespread nature of threat).

[24] See O’Gara, supra note 7 (providing steps organizations can take to better defend themselves from cyber risks).

[25] See The Cyber Threat to Sports Organisations, supra note 3, at 11 (recommending use of MFA).

[26] See What is Multi-Factor Authentication (MFA)?, One Login, https://www.onelogin.com/learn/what-is-mfa (last visited Mar. 25, 2021) (defining MFA and explaining its benefits)

[27] See id. (providing benefits of MFA).

[28] See The Cyber Threat to Sports Organisations, supra note 3, at 16 (explaining how to combat cyber-enabled fraud).

[29] See id. at 19 (providing examples of how to defend from ransomware).

[30] See id. (highlighting proper preventative precautions).