TL;DR: If your passport number leaked in a breach, the Australian Passport Office says your passport is still valid for travel: someone would need the physical passport to travel on it. Compromised passports can be blocked in the Document Verification Service (DVS) so they can’t be used for online ID checks, and a passport number can’t be used to get a new passport. You usually don’t need to replace it. But if you’re asked to use it online and it fails, that’s why.
What the APO says
This guidance from the Australian Passport Office was written after the Optus breach, but the principles apply to any breach exposing passport numbers:
- Travel: "Your passport is still safe to use for international travel." A number alone can’t be used to travel.
- Online ID checks: compromised passports are blocked in the DVS, so they can’t be used to verify identity online.
- In person: you can still show your physical passport.
- New passports: a passport number can’t be used to get a new passport, and facial recognition guards against identity takeover.
- Replacement: usually not required. If you’re travelling soon, don’t apply now, as processing could take longer than your trip.
The same advice after Latitude
When the Latitude Financial breach exposed copies of ID documents, including passports, the APO’s Latitude FAQ repeated the key points and added detail:
- Your details "can’t be used by someone else to travel under your identity": they’d need the physical passport too.
- The government blocked compromised Australian passports from the Document Verification Service, the system used for online ID checks for things like bank and welfare applications. The passport is still valid for ID in person.
- If an online check fails, use another credential or ask the business for another option, like showing the passport in person.
| If you replace it | What the APO says |
|---|---|
| Processing time | Allow at least six weeks; don’t apply if you travel sooner |
| More than 2 years left | You can get a replacement with the same expiry date |
| Under 2 years left (or expired < 3 years ago) | You’ll need a new 10-year passport |
| Cost | Normal fees apply; ask the breached company about reimbursement |
When replacing might make sense
- You lost the physical passport as well (then you must report and cancel it).
- You need to use your passport for online ID checks and it’s now blocked.
- The breaching company offers to pay for a replacement (Optus did; Latitude said it would advise affected customers on reimbursement).
- The company confirms your passport copy was taken, not just your number. The APO says you may want to replace it then, to prevent misuse.
Cancelling a lost or stolen passport
Call 131 232, or if you’re overseas, contact the nearest Australian embassy or consulate.
The real risk from a leaked passport number
The passport itself is fairly well protected. The danger is that the number is often leaked alongside your name, birthday and address, which helps scammers:
- pass weaker ID checks at smaller lenders;
- sound convincing on the phone;
- run "your passport is compromised, pay to replace it" scams.
The APO’s advice: don’t click links or share details with unsolicited contacts.
What to do
- Keep the breach notice.
- Consider a credit ban if your birthday and address also leaked.
- Check your credit report.
- Get help from IDCARE (1800 595 160) if you see misuse.
Breaches exposing ID documents include Optus and Genea. A free exposure check shows which breaches your email is in.
Frequently Asked Questions
Why does my passport fail online ID checks after a breach?
The government blocks compromised Australian passports in the Document Verification Service. It’s still valid in person and for travel. Use another ID online or replace it.
Can someone travel on my passport if they have the number?
No. The Australian Passport Office says they would need the physical passport.
Do I need a new passport after a data breach?
Usually not. The APO says the passport remains valid for travel; replacement may help if it’s blocked for online ID checks.
What is the Document Verification Service block?
Compromised passports can be blocked in the DVS so they can’t be used for online identity checks.
How do I cancel a lost Australian passport?
Call 131 232, or contact the nearest Australian embassy or consulate if you’re overseas.
Sources
- Australian Passport Office: Data breach advice for passport holders
- Australian Passport Office: Latitude Financial Services breach FAQ