Should You Replace Your Passport If The Number Was Accessed In A Breach?

Just one month ago, yet another hotel chain was added to the growing list of hospitality data breaches. It’s a growing list and one that hotel guests hope they never make. According to Starwood Hotels & Resorts Worldwide, hackers gained access to their guest reservation database including Westin, Sheraton, Aloft, and W hotels among others, as early as 2014. Marriot International had purchased Starwood, with the combined total number of hacking victims currently at 500 million. Hackers walked away with massive amounts of guest information, including names, birth date, payment information, phone numbers, email addresses, and possibly the most disturbing hit of them all–passport data.

The hospitality industry continues to be a bonanza for hackers looking to steal and sell identities on the dark web. The difference with this hack is the passport data of millions of travelers could now be in the hands of nefarious actors. It’s unsettling at best to know one’s passport information is out there somewhere in cyberspace, much less figuring out what to do about it. Changing email or financial accounts after a hack is one thing; stolen passport data is another matter.

There’s a possibility a stolen passport number can be used to get a new one, and what scary stuff might the new user do with that passport? The answer to that question is different depending on who’s being asked. The State Department believes the only reason for concern is if one’s passport is physically stolen. On the other hand, the Identity Theft Resource Center believes there’s a need for concern that a stolen passport number can be used to create a fake identity.

For those whose passport data was heisted, the decision to report the theft is currently up to the individual. The information below can assist those who want to be proactive about its potential data theft.

Specifically for passport data theft while still in possession of your physical passport, contact the National Passport Information Center at 1-877-487-2778 or NPIC@state.gov

1. Call the US State Department at 1-877-487-2778 or go online at https://pptform.state.gov/ to report the theft.

2. As soon as possible, fill out Form DS-64 “Statement Regarding Lost or Stolen Passport.”

3. In 2-4 weeks you will have a new passport and be able to travel internationally again.

However, if you are concerned about being stuck in a foreign country because someone used your stolen passport number from a data breach to create a fake identity, you should replace it. As with all of these instances, it’s certainly better to be safe at home, than sorry across the border.

Stickley on Security
Published December 16, 2018