{"id":235118,"date":"2025-10-23T19:19:10","date_gmt":"2025-10-23T19:19:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/ca\/235118\/"},"modified":"2025-10-23T19:19:10","modified_gmt":"2025-10-23T19:19:10","slug":"hackers-gained-access-to-fia-data-including-max-verstappens-passport","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ca\/235118\/","title":{"rendered":"Hackers gained access to FIA data, including Max Verstappen’s passport"},"content":{"rendered":"

The FIA confirmed that a group of ethical hackers briefly gained access to data in its driver licensing portal – including Max Verstappen<\/a>\u2019s passport – while the leak has been fixed in collaboration with the hackers themselves.<\/p>\n

The breach took place this summer, when a trio of ethical hackers \u2014 Gal Nagli, Sam Curry and Ian Carroll \u2014 got into the FIA\u2019s Driver Categorisation portal. Although the successful hack was carried out months ago, they only revealed their findings publicly this week on social media.<\/p>\n

The group, all Formula 1 fans, stressed that they had no malicious intent. The goal was mainly to expose weaknesses in the FIA\u2019s infrastructure and to make the \u201centire ecosystem\u201d stronger.<\/p>\n

The incident involved the system the FIA uses to manage driver classifications. F1 drivers need a super licence to compete, but for other series \u2013 mostly endurance \u2013 the categorisation into Gold, Silver or Bronze is crucially important. Through the portal, the FIA manages these categorisations and drivers can submit requests to change their status as well \u2013 for example from gold to silver, which can be beneficial for endurance racing where teams are often required to field a silver-rated driver.<\/p>\n

Admin role gave hackers access to driver data<\/p>\n

The hackers created a profile on the FIA portal and discovered via Javascript that it was possible to modify their role. The portal\u2019s framework included multiple roles: drivers, FIA staff, and administrators.<\/p>\n

Using an HTTP PUT request, the hackers attempted to elevate their access rights to admin status – and it worked. Upon logging back in, they found a completely different interface, including the FIA\u2019s internal dashboard for managing driver classifications.<\/p>\n

\"FIA <\/p>\n

FIA logo<\/p>\n

Photo by: Gabriele Lanzo \/ Alessio Morgese \/ NurPhoto via Getty Images<\/p>\n

To verify the breach, the group attempted to load a single driver profile. They discovered that it showed password hash, email address, phone number, and passport details to them, along with internal correspondence between the FIA and the driver regarding the categorisation.<\/p>\n

All F1 drivers were also listed in the system, with the hackers noticing that Verstappen\u2019s passport could be accessed. The hackers emphasised that they stopped their testing at that point and did not access any passport or sensitive information.<\/p>\n

FIA response and working with the hackers<\/p>\n

After identifying the vulnerability on 3 June, the hackers immediately notified the FIA. The governing body took action – taking the site offline the same day and working with the trio to find a permanent solution. On 10 June, the FIA confirmed that a fix had been implemented.<\/p>\n

When asked by Motorsport.com in Mexico, an FIA spokesperson confirmed the incident and shared an official statement from the governing body:<\/p>\n

\u201cThe FIA became aware of a cyber incident involving the FIA Driver Categorisation website over the summer. Immediate steps were taken to secure drivers\u2019 data, and the FIA reported this issue to the applicable data protection authorities in accordance with the FIA\u2019s obligations. It has also notified the small number of drivers impacted by this issue. No other FIA digital platforms were impacted in this incident.<\/p>\n

\u201cThe FIA has invested extensively in cyber security and resilience measures across its digital estate. It has put world class data security measures in place to protect all its stakeholders and implements a policy of security-by-design in all new digital initiatives.\u201d<\/p>\n

Read Also:<\/p>\n

We want your opinion!<\/p>\n

What would you like to see on Motorsport.com?<\/p>\n

Take our 5 minute survey.<\/a><\/p>\n

– The Motorsport.com Team<\/p>\n","protected":false},"excerpt":{"rendered":"The FIA confirmed that a group of ethical hackers briefly gained access to data in its driver licensing…\n","protected":false},"author":2,"featured_media":235119,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[441],"tags":[110366,49,48,578,576,577,111288,111289,110365,82],"class_list":["post-235118","post","type-post","status-publish","format-standard","has-post-thumbnail","category-formula-1","tag-autodromo-hermanos-rodriguez","tag-ca","tag-canada","tag-f1","tag-formula-1","tag-formula1","tag-hackers-gained-access-to-fia-data","tag-including-max-verstappens-passport","tag-mexican-gp","tag-sports"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/235118","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=235118"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/235118\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/235119"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=235118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=235118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=235118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}