Passport numbers leaked: what it means and what to do
Risk level: critical. Can you change it: no. Found in 11 breaches in this directory.
What this data is
The unique number printed on your passport, often stored with your full name, nationality, date of birth and expiry date by airlines, hotels, travel agents, exchanges and identity verification services.
The risk on its own
A passport number alone does not let someone travel as you, because border control checks the physical document and your face. It is, however, an accepted identity reference for many online checks, including bank, crypto exchange and rental applications. Once it leaks you cannot choose who gets to use it as proof of you.
The risk combined with other data
With your name, date of birth and nationality, the number reproduces the data page of the passport in text form. That is enough to pass many remote identity checks and to create a forged document template. It is also a key ingredient in synthetic identities, where real and invented details are blended into a new person.
How criminals use it
A crypto exchange or online lender accepts your passport details during sign up and opens an account in your name.
A forger uses your real details to produce a fake passport scan that survives an online document check.
A scammer poses as the passport office, quotes your number, and charges a fee to cancel the compromised passport.
Your passport details are used in a rental or employment application, leaving debts or records under your identity.
What to do now
Contact your country's passport office and ask whether the number can be flagged or the passport replaced because of the breach.
Place a credit freeze with each credit bureau so lenders cannot open accounts using your identity.
Check whether your government runs an identity document verification service that can block the number, and register if it does.
Treat any call or email about your passport as unverified, and contact the passport office through its official website only.
Review your credit report now and again in three months for accounts you do not recognise.
Keep the breach notification as evidence in case you need to dispute fraud later.
Frequently asked questions
Should I get a new passport?
Ask your passport office. Some will replace a passport after a confirmed breach, others will not. A replacement ends the exposure of that number, but copies of your name and birth date remain.
Can someone travel on my passport number?
No. Border checks use the physical document, the chip and your face. The realistic risk is online identity checks, not travel.
Does a credit freeze help with a passport leak?
Yes. The main financial risk is new credit opened in your name, and a freeze stops lenders pulling your file.
Breaches that exposed this data
Медицинская лаборатория Гемотест (Gemotest): 2022-04-22, 6.3M accounts, Dates of birth, Email addresses, Genders, Government issued IDs, Health insurance information, Names
Odido: 2026-02-12, 6.1M accounts, Bank account numbers, Customer service records, Dates of birth, Driver's licenses, Email addresses, Genders
MalindoAir: 2019-03-01, 4.3M accounts, Dates of birth, Email addresses, Genders, Loyalty program details, Names, Nationalities
RentoMojo: 2023-04-15, 2.2M accounts, Dates of birth, Email addresses, Genders, Government issued IDs, Names, Passport numbers
University of Nottingham: 2026-06-09, 455K accounts, Academic records, Citizenship statuses, Dates of birth, Disabilities, Email addresses, Ethnicities
Utair: 2019-03-21, 401K accounts, Dates of birth, Email addresses, Genders, Loyalty program details, Names, Passport numbers
GoldSilver: 2018-10-21, 243K accounts, Bank account numbers, Email addresses, IP addresses, Names, Partial credit card data, Passport numbers
COMELEC (Philippines Voters): 2016-03-27, 229K accounts, Biometric data, Dates of birth, Email addresses, Family members' names, Genders, Job titles
StarNet: 2015-02-26, 139K accounts, Customer interactions, Dates of birth, Email addresses, Genders, IP addresses, MAC addresses
eThekwini Municipality: 2016-09-07, 82K accounts, Dates of birth, Deceased date, Email addresses, Genders, Government issued IDs, Names
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.