Citizenship statuses leaked: what it means and what to do
Risk level: high. Can you change it: no. Found in 3 breaches in this directory.
What this data is
A field recording whether you are a citizen, permanent resident, visa holder or other status, sometimes with a visa type, country of birth or expiry date. It appears in HR, bank, government and education records.
The risk on its own
On its own it does not open accounts, but it is legally and personally sensitive. People on temporary visas or waiting on a decision are often anxious about anything involving immigration authorities, and criminals know it. For some people, disclosure also leads to discrimination by landlords or employers.
The risk combined with other data
Joined to your name, phone number and visa expiry, it is the targeting data behind fake immigration officer calls that threaten deportation or cancellation unless a payment is made immediately. Combined with passport or visa numbers from the same breach, it also supports identity fraud. Victims in this group are sometimes reluctant to report, which scammers count on.
How criminals use it
A caller claiming to be from the immigration department says there is a problem with your visa and demands a fine paid by gift card or cryptocurrency.
A fake migration agent offers to fix a problem with your application in exchange for an upfront fee.
Fake job offers aimed at visa holders ask for passport scans and bank details for a right to work check.
A landlord or employer who obtains the data discriminates based on your status.
What to do now
Know that immigration authorities do not phone demanding immediate payment, and never take gift cards or cryptocurrency. Hang up and contact the department through its official website.
Check your status directly: VEVO or ImmiAccount in Australia, a USCIS online account in the US, or the View and prove your immigration status service on GOV.UK.
Use only registered advisers: the Register of Migration Agents in Australia, the Immigration Advice Authority register in the UK, or accredited representatives listed by the US Department of Justice.
If passport or visa numbers leaked too, tell the issuing authority and follow the steps for leaked government IDs.
Report scam calls to your national reporting service, such as Scamwatch in Australia, the FTC in the US or Report Fraud in the UK.
Frequently asked questions
Will my visa be cancelled because of a data breach?
No. Your status is not affected by a company losing your data. Anyone who says otherwise and asks for money is running a scam.
How do I check whether an immigration call is real?
Hang up, find the department's contact details on its official government website, and ring it yourself. Real officers do not demand payment over the phone.
Can I report a scam if I am worried about my immigration situation?
Scam reporting services exist to track fraud, not to check immigration status. If you are worried about contact with authorities, speak to a registered migration adviser or a community legal service first.
Breaches that exposed this data
Houston City College: 2026-06-16, 832K accounts, Academic records, Citizenship statuses, Dates of birth, Email addresses, Genders, Names
University of Nottingham: 2026-06-09, 455K accounts, Academic records, Citizenship statuses, Dates of birth, Disabilities, Email addresses, Ethnicities
DC Health Link: 2023-03-06, 48K accounts, Citizenship statuses, Dates of birth, Email addresses, Employers, Ethnicities, Genders
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.