Hacking Formula 1: Accessing Max Verstappen’s passport and PII through FIA bugs

According to DataBreaches[.]Net, a group including Gal Nagli, Ian Carroll and Sam Curry demonstrated how they could access Max Verstappen’s passport, driver’s licence, and personal information, along with that of other Formula 1 drivers. They stated it took 10 minutes to exploit a single security flaw. The researchers identified a Mass Assignment vulnerability in the FIA – Fédération Internationale de l’Automobile Driver Categorization Portal, which allegedly allowed them to become administrators in the system.

The post notes this is part 1 of a three-part series detailing vulnerabilities found in Formula 1. The announcement was published on 22 October 2025.