The Caesars Entertainment and Circa Casino are in the news due to the largest known leak of North American driver’s license scans. Both Las Vegas casino operators were identified as clients of IDScan.net, an identity verification provider. Caesars was listed on IDScan’s public client/trust page, while Circa was mentioned in a case study about using the company’s VeriScan system to scan IDs at its 21-and-over entrances.

The FBI has initiated an investigation into a dark-web marketplace selling over 153 million U.S. and Canadian driver’s license scans. These scans are believed to have been obtained from IDScan, but the company has not confirmed any breach as of Thursday morning (Sept. 3).

Caesars responded by stating that they were not using IDScan’s services at the time of the incident, and therefore, it should not impact them. Circa Casino has not yet commented on the matter.

Nexus Point

The stolen records were advertised on the Russian-language cybercrime forum Exploit by a service called Nexus. It claimed to have access to identity documents of over 170 million individuals, including driver’s licenses, identification cards, travel documents, and medical cards. Security journalist Brian Krebs linked the data to IDScan based on timestamps and scan types.

After Krebs’ report, IDScan stated that it was investigating the incident and working to determine if unauthorized access occurred. The data’s authenticity was confirmed by finding personal records in the stolen set.

The FBI’s New Orleans office has opened an investigation into the matter.

Unique ID-Theft Danger

The stolen data poses a unique threat as it includes six images per document, including infrared and ultraviolet scans. This comprehensive data can be used to create a “spectral fingerprint” of a real license, making it difficult to detect fakes. Simply replacing a driver’s license may not be enough to prevent identity theft, as the old data may still exist in various systems.