actually that is the one next thing they would need but can get with enough verifiable information like your passport number etc easily without hacking or paying... as i mentioned before though you are right in the fact they are probably not going to do anything with the information other than probably sell it in bulk on the internet...
some people are more paranoid than others and consider everything that looks questionable to be questionable ... which in this day and age is usually the better way to be
just to point out for people who dont know it these are almost all of the things a person would need to open a credit accountor make purchases in your name or more.... added together with collectable data on the internet that is already available about any given person and they have what they need ...
most likely though they are selling them in batch to some group in another country that will do whatever with that information.
just make sure to report your current passport lost or stolen(i suggest lost because stolen you need to report it to the local police also) or they will just give you the same number ... I don't know if they give you the option to ask for a new number based on suspected fraud