Curaçao Gambling Hack Unmasks Some 800 Hidden Casino Owners, Most of Them European

What the Curaçao gambling hack revealed

A nine-month intrusion into the Curaçao Gaming Authority (CGA) has exposed who really owns hundreds of offshore online casinos. Most of those owners, it turns out, are European.

The leaked files link around 800 beneficial owners to the 646 companies that held a Curaçao gambling licence in December 2025. Together, those firms run thousands of websites, including brands that regulators across Europe have fined or blacklisted.

The documents also suggest the regulator routinely approved licences while basic questions about ownership went unanswered. The CGA has not disputed that point. Several of the industry's best-known crypto casinos and sportsbooks are among the brands whose owners of record now appear in the cache.

For European authorities, the leak delivers something they have lacked for decades: names. Until now, a wall of anonymous letterbox firms has hidden the people in charge from regulators and tax collectors alike.

How a fake licence applicant got inside the regulator

The breach began with a simple deception. In December 2025, Berlin-based hacker Lilith Wittmann signed up to the CGA's licensing portal. She posed as a Dutch trust-office manager the regulator already knew, but entered her personal email address.

She claimed to represent a foundation she had invented, and access was granted within days. By her own account, she found an exploitable security flaw within hours of logging in.

That flaw opened the entire licence-management system, where every application and supporting document was stored. Wittmann says she then watched the regulator "at work in real time" for roughly nine months, unnoticed by staff.

The CGA has confirmed that an account created under a false identity used its portal from December 2025 until September 2026. It says the intrusion has been contained, calls it a serious breach under Curaçao law and will report it to the authorities.

The haul is vast. It includes ownership declarations, licence applications, the regulator's internal assessments, passports, tax returns and financial records.

On 23 September, a searchable public archive of more than 40,000 documents went online under the name Casino Secrets. Anyone can look up companies and domains, although the site stresses that appearing in the files does not imply illegal conduct.

Wittmann is no stranger to gambling regulators' servers. Earlier in 2026, she breached a system belonging to the Malta Gaming Authority.

A European ownership network behind Caribbean letterboxes

Nationals of Ukraine, the United Kingdom and Cyprus lead the list of owners identified in the files, while 13 are Dutch. On paper, their businesses are Curaçao letterbox companies administered by local trust offices.

That gatekeeping layer is remarkably small. Just 40 representatives from 30 trust offices dealt with the regulator on the licensed firms' behalf, and 31 of them hold Dutch passports.

The files also reach the top of the market. Four cases stand out:

When approached, the sportsbook's representatives said they could not respond to assumptions drawn from documents they had not seen. The Brazil-facing casino's owners and the operator fined in the Netherlands did not reply. Appearing in the files does not mean anyone has broken the law.

In Germany, reporters working through the files linked roughly 1,000 casino domains to operators tied to one casino software supplier. The supplier says it runs no casinos and likens its role to that of an office-software vendor. The CGA dismissed the grouping as the reporters' own invention.

The same series of revelations reaches into Germany's largest illegal-casino case. On 8 September, more than 100 officers searched 11 properties, mostly around Frankfurt, and arrested a main suspect. Prosecutors allege the unlicensed casino took about €5.86bn in stakes between July 2021 and the end of 2023.

Germany's joint gambling regulator, the GGL, has since identified the German-facing online casino at the centre of the case. Wittmann, who ties the casino to Curaçao, estimates the German gambling-tax shortfall at around €250m, a figure not officially confirmed. The software supplier says it may have provided individual components to that casino but played no part in running it.

The story also reaches the Nordics. Public broadcasters in Norway and Sweden examined the files alongside Dutch, German and Austrian newsrooms, and Norwegian reporting found Norwegians among the licence applicants.

Curaçao's licensing overhaul under fire

The leak lands just as Curaçao tries to shake off its long-standing reputation for lax oversight. For almost 30 years, a few private master-licence holders sold sublicences to operators worldwide, with the state barely involved.

That licence never allowed operators to take bets in other countries. Its appeal was access: to local trust offices, payment firms and casino software vendors, plus a stamp that made operators look legitimate.

Under pressure from the Netherlands, Curaçao passed the National Ordinance on Games of Chance (LOK) in 2024, putting operators under direct CGA supervision. A licence now costs about €47,450 a year, and the regulator tightened its rules for crypto operators in June.

The CGA says the sector is still in transition. New requirements are being phased in step by step, a choice made under the finance minister's responsibility. The regulator adds that it does not refuse licences at the first sign of doubt.

It also says it has rejected about 28% of applications since 2023 and that its licences do not cover markets such as Germany. It warns against judging applications from single documents without the full file.

Critics are unconvinced. Marcel Pheijffer, a forensic accounting professor at Nyenrode Business University, said such an approach would be impossible in the Netherlands. A regulator, he argued, should think before it acts.

Björn Fuchs, chairman of Dutch online gambling association VNLOK, went further. He said the new law appears to be "failing miserably" and urged the regulator to refuse licences when red flags remain.

What happens next

The fallout is only beginning. The CGA's forensic investigation is still running, and Wittmann has said she plans to release the full list of beneficial owners.

In Curaçao, scrutiny is shifting to the Ministry of Finance. The regulator says the slow rollout of the new rules was decided under the minister's responsibility, and local media are already asking what instructions the CGA received.

Businesses that rely on declared ownership data face their own reckoning. Banks, payment providers and crypto firms that work with Curaçao-licensed operators may need to revisit their due-diligence files.

The legal fight over Wittmann's methods is far from settled. According to Wittmann, the Malta Gaming Authority recently lost an interim case against her in Berlin, so she can keep using its documents.

For players, the takeaway is simple: a Curaçao licence reveals little about who runs a casino. Nor does it make an operator legal in countries such as Germany or the Netherlands, which require a national licence.

FAQ

What happened in the Curaçao gambling hack?

A hacker registered on the Curaçao Gaming Authority's licensing portal under a false identity in December 2025. She then had access to the regulator's licence-management system for about nine months, until the breach was detected in September 2026.

Who is behind the Curaçao Gaming Authority hack?

Berlin-based hacker and security researcher Lilith Wittmann has claimed responsibility. Earlier in 2026, she also breached a system of the Malta Gaming Authority.

How many casino owners were exposed?

The files link around 800 beneficial owners to 646 companies licensed in Curaçao as of December 2025. Most of the owners are European, led by nationals of Ukraine, the UK and Cyprus.

Are major casino brands affected by the leak?

Yes. Several of the best-known crypto casinos and sportsbooks licensed in Curaçao appear in the documents, alongside hundreds of lesser-known operators. Being named in the files does not by itself indicate wrongdoing.

Can a Curaçao-licensed casino legally operate in Europe?

Not on the strength of that licence alone. A Curaçao licence does not authorise gambling in countries such as Germany or the Netherlands, which require their own national licences.

How has the Curaçao Gaming Authority responded?

The CGA confirmed the unauthorised access, says it has been contained and calls it a serious breach under Curaçao law. It says the industry is in a transition period and warns against drawing conclusions from individual documents.