Do I have to replace my ID card after a data breach?

Usually not. A leak of your PESEL number or the series and number of your ID card does not invalidate the document and is not in itself a reason to replace it. Replacement makes sense when a scan or photo of the card leaked, because someone then holds the full set of details together with the document's image. In both cases, reserving your PESEL number matters more and works faster.

Why replacement alone achieves little

A new ID card means a new series and number, but your PESEL number stays the same. Since it is the PESEL that institutions use to identify a person, replacing the document alone closes only part of the problem and takes several weeks. Reserving your PESEL number takes minutes and works immediately.

When replacement does make sense

Consider it when:

• a scan or photo of the card leaked, rather than plain text details,
• the document was used to confirm identity remotely, for example in selfie-with-ID verification,
• you have signals that someone has already tried to use your document.

The mere fact that your PESEL number and e-mail address appeared in a breached database is not enough to warrant replacement.

The order of actions after a breach

1. Reserve your PESEL number in the mObywatel app, on gov.pl or at the municipal office. If you are not planning to take out credit, leave the reservation switched on permanently.
2. Reserve the document in the Dokumenty Zastrzeżone system if its scan leaked.
3. Switch on BIK alerts and watch for credit enquiries.
4. Change passwords in services where you reused the same one, and switch on two-factor authentication.
5. Prepare for phishing. After a breach the number of messages quoting real details to make a request look credible goes up.

Example

Anna is notified that a ticketing service she used leaked her name, e-mail address and PESEL number. No scan of her ID was involved. Anna reserves her PESEL number, switches on BIK alerts and leaves it at that. She does not replace her ID card, because the document has not expired and has not fallen into anyone’s hands as an image. Had a scan leaked, the decision would have been the opposite.