You don't need to. If the verifier has no way of verifying that any given passport number is correct, or associated with the identity you're trying to steal, then you can make up any number you like. Like you said, the only thing they can do is verify that the number on the (faked) passport matches the number the fraudster typed in the form.

If anything, this breach improves security because now there is a list of passport numbers matched to identities that verifying companies can use to make sure that the passport number claimed by a potential imposter matches the number known for that identity (from this breach). Then you'd have to do what you said and alter the passport in some way to match the breach.