JADA: flaw in its expense system lets outsiders take names and addresses of 1,792 doping control officers and others

1. 2026-10-25

   An outsider used a flaw in the expense system to take registered data. [1]

2. 2026-10-26

   The system was shut down. [1]

3. 2026-10-29

   Individual notices began to those whose contact details were known. [1]

4. 2026-11-02

   The agency announced the incident. [1]

Names, name readings, dates of birth, addresses, phone numbers, email addresses, doping control officer certification numbers, travel routes for expense claims and similar data of 1,792 people registered for expense payments were taken, along with the names of 594 business partners. [1]

Those affected include doping control officers, lecturers and staff. No card or bank data, and no athlete testing, whereabouts or therapeutic use exemption data, was involved. [1]

Part of the system had a vulnerability that let registered data be retrieved without logging in. No unauthorized logins or changes were recorded, and the system is not linked to other systems. [1]