Places of birth leaked: what it means and what to do
Risk level: medium. Can you change it: no. Found in 3 breaches in this directory.
What this data is
The town, city or country where you were born, recorded by government services, banks, insurers, airlines and some websites as an identity detail or security question.
The risk on its own
A birthplace cannot open an account on its own, and it is often visible on public profiles. It matters because it is printed on passports and birth certificates and used as a security question. A permanent fact you cannot change should never be relied on as a secret, but many systems still do.
The risk combined with other data
With your full name and date of birth, a place of birth matches the details on your passport and birth certificate. That strengthens identity fraud applications and can help order a copy of a birth certificate in some places. It also answers the question what city were you born in on older accounts.
How criminals use it
An old email account with the security question what city were you born in is reset using the leaked answer.
A fraudster uses your name, date and place of birth to apply for a copy of your birth certificate in a jurisdiction with weak checks.
Passport details from another leak are completed with your birthplace to create a convincing fake document scan.
A scammer claiming to be a relative or old neighbour mentions your hometown to build trust.
What to do now
Change any security question answer that uses your birthplace to a random phrase stored in your password manager.
Remove your hometown from public social media profiles.
Consider a credit freeze if your full name and date of birth leaked in the same breach.
Ask your birth registry whether you can be alerted to certificate requests or restrict who can order copies.
Frequently asked questions
Is my place of birth sensitive?
Moderately. It is a fixed identity detail on passports and birth certificates, which is why it should not be a security answer.
Should I lie on security questions?
Yes, as long as you store the answers in a password manager. A random answer cannot be found in a leak or on social media.
Can someone get my birth certificate with this?
In some places the checks are weak. Your registry can tell you what proof they require and whether you can restrict access.
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.