Air Canada states they haven't detected any improper login attempts, etc since the breach was discovered.
They probably aren't going to either ... people who steal credentials from insecure servers generally wait about six months before they use the data against the victims. This makes the source of the purloined data more difficult to detect.
Unlike in the US, Canadian Social Insurance Numbers (equivalent to Social Security numbers in the US) are not generally used as ID. The Government of Canada warns citizens not to use it for that purpose, and even to never carry their SIN card with them. It is required if the other party pays the SIN holder income, such as a job or an interest paying bank account.
By law no one not legally required to obtain a SIN is prohibited from even asking for one. However with paper forms sometimes there is a space to enter it, as the SIN owner can voluntarily provide it, but that field cannot be mandatory in any way.
I have never provided mine to anyone not authorized to ask for one, and as such it is not part of my Credit File. This has never resulted in any problems in applying for Credit (eg Credit Cards) although every CC application does have the field to fill out, usually down the application a bit past the required identification fields, if the SIN card owner is unaware of the law and the requirements, so many Canadians have provided it and in that case it does appear on the Credit File.
Passport data is perhaps even more serious. I would expect that it would be valuable to certain people*, so it will be interesting to see what Air Canada suggests to those affected, and what Canada will do to deal with the breach. I would not be surprised to learn that affected individuals may be required to obtain new Passports.
* Aside from the usual criminally minded individuals who would like to exploit any credential theft for the usual reasons, certain State actors have used forged Canadian passports in the past as part of shady operations. Notably the Mossad (Israeli Intelligence) have been caught doing so.