Spa Grand Prix email account hacked to phish banking info from fans

Hackers hijacked the official contact email for the Belgian Grand Prix event and used it to lure fans to a fake website promising a €50 gift voucher.

The Spa Gran Prix is a Formula 1 World Championship race held at the Circuit de Spa-Francorchamps in Stavelot, Belgium. This year, the race will take place between July 26 and 28 and tickets are available through the official website.

The circuit’s challenging layout, historical significance, and dynamic weather conditions make the event one of the most prestigious on the Formula 1 calendar, attracting fans from all over the world.

In a press release sent to BleepingComputer, the race organizer explains that the email account was hijacked on Sunday, March 17, 2024 and was followed by the threat actor sending fraudulent emails to an undisclosed number of people.

The message informed the recipient that a €50 voucher for purchasing tickets for the F1 Grand Prix could be claimed by clicking on an embedded link.

The link redirected to a fake website that resembled the official portal of the Spa Grand Prix, where they were asked for personal details, including banking info.

SPA GP reacted to the situation “within a few hours” and sent a round of emails to alert customers that the previous message was a phishing attempt, warning them not to click on any links.

Additionally, the organization asked its IT security subcontractor to implement additional security measures to prevent this from happening again. On March 18, it filed a complaint with the Belgian cyber police.

SPA GP stated that it will also file a civil claim with an examining magistrate in the following days.

BleepingComputer asked SPA GP about the number of impacted individuals and what other information, besides email addresses, the hackers have accessed, but we have yet to receive further clarification.

“The criminal investigation currently underway should make it possible to determine the causes and circumstances that led to this situation,” reads the organizer’s statement.

“For the time being, therefore, we must let the courts do their work while respecting the confidentiality of the investigation.”

Users who purchased tickets previously and are worried about the possibility of their data having been exposed to cybercriminals are advised to contact SPA GP’s secretariat.

The organization finally emphasized that this incident did not impact its website at “spagrandprix.com” and the official ticketing system remains fully secure.