FIA Confirms Major Cyber Breach Exposing Max Verstappen’s Personal Data

Formula One's governing body, the Federation Internationale de l'Automobile (FIA), has confirmed that it suffered a cybersecurity breach earlier this year, compromising personal details of thousands of registered

drivers, including reigning F1 world champion Max Verstappen.

The FIA revealed in a statement at the Mexico City Grand Prix on Thursday that the breach occurred "over the summer" and specifically targeted its Driver Categorisation website - a platform used to manage licensing and driver status details. Hackers reportedly accessed passport numbers, contact information, and other sensitive data of nearly 7,000 drivers worldwide.

"Immediate steps were taken to secure drivers' data, and the FIA reported this issue to the relevant data protection authorities in line with its obligations," the governing body stated. "It has also informed the small number of drivers affected by this issue. No other FIA digital platforms were impacted by this incident. "

The FIA stressed that it has strengthened its digital security infrastructure since the incident. "The FIA has made significant investments in cybersecurity and resilience measures across its digital platforms. It has implemented world-class data security measures to protect all stakeholders and enforces a security-by-design policy in all new digital initiatives," the statement added.

The breach first came to light on Wednesday when cybersecurity researcher Ian Carroll disclosed that he and two colleagues had inadvertently gained access to confidential FIA data in June. After their request for administrative access to the site was mistakenly approved, they discovered highly sensitive files, including Verstappen's passport, super licence, and personal documents.

"We stopped testing after realizing it was possible to access Max Verstappen's passport, resume, licence, password hash, and PII (personally identifiable information)," Carroll told Crash.net. "This data could be accessed for all F1 drivers with a categorisation, alongside sensitive information of internal FIA operations. We did not access any passports or sensitive information, and all data has been deleted. "

Following the revelation, the FIA temporarily took the website offline on June 3 and restored it a week later after conducting a full security overhaul. Verstappen, who is currently chasing his fifth consecutive world title, has yet to comment publicly on the data breach.