A group of self-described hackers exploited a vulnerability in the FIA Driver Categorisation website, gaining unauthorized admin access within 10 minutes. They retrieved Max Verstappen’s passport, personal contact details, FIA correspondence, license documents, password hashes, and other PII (Personally Identifiable Information). The breach also exposed internal FIA communications, committee discussions on driver performance, private evaluations, and confidential decision-making processes for multiple F1 drivers (including Lando Norris, Fernando Alonso, and Nico Hülkenberg). The attackers demonstrated the flaw by accessing sensitive data but claimed they did not download or retain any passports or sensitive files, deleting all retrieved data before reporting the incident to the FIA. The governing body confirmed the breach was contained, notified affected drivers, and reported the incident to data protection authorities. No other FIA digital platforms were compromised. The exploit highlighted critical gaps in the FIA’s access control and security-by-design policies, despite their stated investments in cybersecurity.

Hackers exploited vulnerabilities in the FIA’s Driver Categorisation website, gaining administrator privileges by registering a standard user account and escalating access. The breach exposed sensitive personal data of nearly 7,000 drivers, including world champion Max Verstappen, such as passports, résumés, licenses, password hashes, and PII (personally identifiable information). Researchers (including Ian Carroll) discovered the flaw in June, immediately reporting it to the FIA, which secured the system, took the website offline (June 3rd), and applied a fix within a week. The FIA confirmed no data was stolen or retained by the hackers, who deleted all accessed information. However, the incident required notifications to affected drivers and data protection authorities. The breach was isolated to this platform, with no impact on other FIA digital systems. The organization emphasized its cybersecurity investments, including security-by-design policies for new initiatives.

The Fédération Internationale de l'Automobile (FIA), the governing body of Formula One, experienced a cyber security breach where hackers exposed personal details of drivers, including four-time world champion Max Verstappen. The incident involved unauthorized access to sensitive data, potentially compromising private information of high-profile racing professionals. While the exact scope of the breach (e.g., financial data, medical records, or contact details) was not fully disclosed, the exposure of such information poses reputational risks for the FIA and privacy threats for the affected drivers. The breach could lead to identity theft, targeted phishing, or harassment of the individuals involved. Additionally, the FIA’s failure to prevent such an attack may erode trust among stakeholders, including teams, sponsors, and fans. The incident highlights vulnerabilities in the organization’s cybersecurity defenses, particularly in safeguarding high-value targets within the motorsport industry. No immediate financial losses or operational disruptions were reported, but the leak of personal data remains a critical concern, especially given the high-profile nature of the victims.

The FIA, the governing body of Formula 1 and motorsport, suffered a data breach on its Driver Categorisation website in June 2024, exposed by security researcher Ian Carroll. Hackers exploited vulnerabilities to access sensitive personal information of nearly 7,000 drivers, including Max Verstappen, the four-time world champion. Compromised data included passport details, résumés, driver’s licenses, password hashes, and personally identifiable information (PII). While the hackers (including Carroll) claimed they did not retain or misuse the data and reported the breach immediately, the incident revealed critical flaws in FIA’s cybersecurity.The FIA took the affected website offline on June 3, implemented a fix within a week, and notified impacted drivers and data protection authorities. Despite no evidence of data theft or further exploitation, the breach exposed internal FIA operations alongside driver records, raising concerns over reputational damage and regulatory compliance. The FIA emphasized its investment in ‘world-class’ cybersecurity measures, but the incident highlighted vulnerabilities in handling high-profile athlete data. The breach did not affect other FIA digital platforms, but the exposure of elite drivers’ confidential documents—including a global sports icon like Verstappen—intensified scrutiny over the organization’s data protection protocols.