Passport Applicants Targeted in the 339K Record Rush My Passport Breach

HEROIC analysts discovered the Rush My Passport breach while monitoring databases that had been quietly circulating in hacking forums since June 2020. The breach exposed 339,800 records belonging to customers of the US passport expediting service. The leaked data included email addresses, phone numbers, full names, and birthdates, all submitted by individuals in the process of applying for or renewing identity documents.

How Stolen Passport Service Data Fuels Identity Theft and Document Fraud

Customers who used Rush My Passport had already provided high-confidence personal details for identity verification purposes. When that same data is accessable to criminals, it becomes a ready-made package for identity theft, synthetic fraud, and social engineering. Birthdates combined with full names and phone numbers allow attackers to pass identity verification challenges at financial institutions and government services with alarming ease.

What Was Exposed in the Rush My Passport Breach

• Email Address
• Phone Number
• First Name
• Last Name
• Birthday

Why Passport Applicants Are Partcularly Vulnerable After This Breach

People who use passport expediting services often do so during high-stakes life moments: international travel, new jobs, or relocation. The data they submit is accurate and detailed by necessity. When that information is seperate from their control through a breach, it can be used to open fraudulent accounts, bypass identity checks, or impersonate them in ways that are difficult to detect and even harder to undo.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to stored user records, typically by exploiting vulnerabilities in web applications or backend systems. Once inside, the attacker extracts the data and distributes it across hacking communities. For services handling identity-adjacent data like passport applications, the consequences extend well beyond a simple credential compromise, touching on fraud, impersonation, and long-term identity risk.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion exposed records and can tell you in seconds if your personal information from Rush My Passport or any other breach is already in circulation. Run a free check now to understand your exposure.