Iraq Nationality and Passports Directorate Leak: IDs Exposed

HEROIC analysts found 8,733 records reportedly tied to the Iraq Nationality and Passports Directorate exposed online, dated 01-Jan-2023, including full names, birthdays, phone numbers, email addresses, and national identification numbers. The only way to know if you're affected is to scan your email.

Why This Data Is Dangerous

This isn't just a list of email addresses. A full name paired with a date of birth and a national ID number is often enough on its own to pass identity checks used by banks, government offices, and call centers. Anyone holding this combination can plausibly claim to be the person named in the record.

What Was Exposed

• Email Address: gives attackers a direct channel for phishing messages aimed at this person.
• Phone Number: enables scam calls and text based phishing targeted at the individual.
• First Name: lets a scammer personalize a message to make it feel legitimate.
• Last Name: combined with a first name, confirms a specific identity to target.
• Social Security Numbers: a key identity credential that can be used to open accounts or pass verification checks.
• Birthday: frequently used to confirm identity or reset account access.

How This Record Combination Enables Identity Theft

If this data is accurate, whoever holds it has enough to open financial accounts, file fraudulent benefit or service claims, or pass identity checks in the named person's name. Paired contact details also make a phishing message far harder to dismiss, since it already knows the recipient's name, phone number, and birthday.

How a Directorate Database Like This Gets Exposed

Records like these are typically pulled directly from an organization's own record keeping systems rather than collected from individual devices. Once a copy leaves that system, it can be copied, resold, and recirculated indefinitely, which is why files like this one tend to resurface on file sharing channels years after the original leak.

Is Your Information in the Iraq Nationality and Passports Directorate Leak?

The fastest way to check is to scan your email against this and other known leaks.

If your information turns up, treat any unexpected call, text, or email that references your name, birthday, or ID number with suspicion, and never confirm personal details to someone who contacted you first. This applies to personal and work email alike.