jili tutorial

Curaçao Casino Data Breach: What the Leaked Files Reveal About Offshore Gambling Ownership

By jili tutorial · September 23, 2026

Curaçao Casino Data Breach: What the Leaked Files Reveal About Offshore Gambling Ownership

The Biggest Regulatory Leak in Curaçao’s Gambling History

In what is being described as one of the most significant data breaches to hit the Caribbean gambling jurisdiction, the Curaçao Gaming Authority (CGA) has seen thousands of sensitive documents exposed. The leak, which lasted roughly nine months, has pulled back the curtain on hundreds of individuals connected to online gambling companies operating under Curaçao licenses. These are companies that have historically operated with remarkable opacity, making it nearly impossible for outsiders to determine who truly controls them.

The investigation was spearheaded by the Dutch investigative outlet Follow the Money (FTM), which operates the project under the name Casino Secrets. By combing through tens of thousands of files from the regulator’s licensing portal, the team was able to piece together a far clearer picture of who actually owns and profits from some of the most recognizable brands in online gambling.

The documents reviewed included not just license applications but also ownership declarations, regulatory assessment notes, passport scans, tax filings, and detailed financial statements. Together, they represent a treasure trove of information that regulators, journalists, and competitors have been seeking for years.

Who Was Behind the Breach and How Did It Happen?

The breach was claimed by Lilith Wittmann, a Berlin-based cybersecurity researcher known for exposing security flaws in public and private sector systems. Wittmann’s approach was not a brute-force hack or a malicious intrusion. Instead, she used a technique often employed by security researchers: she registered on the CGA’s official licensing portal under the guise of a legitimate trust-office manager.

She submitted the registration on behalf of a fictitious entity called DreamCatcher Private Foundation, using her personal Gmail address for correspondence. Within a matter of days, the system granted her access. Once inside, she uploaded software designed to scrape and extract the portal’s contents, giving her—and subsequently the FTM investigation team—a wide window into the regulator’s internal files.

What’s especially alarming about this method is how simple it was. There were no advanced hacking tools, no zero-day exploits, and no state-sponsored techniques. The breach succeeded because the CGA’s system lacked basic identity verification and access controls. The regulator essentially let her in the front door with a fake name and a free email account.

What the Leaked Data Reveals: Ownership Structures Unmasked

One of the most consequential findings from the leak is the sheer volume of ownership data now available for public scrutiny. The FTM investigation identified approximately 800 owners linked to nearly 650 licensed gambling firms operating under Curaçao jurisdiction. Additionally, the data confirmed 897 records of ultimate beneficial owners (UBOs) tied to 767 individuals across 646 entities.

Ultimate beneficial ownership refers to the real people who ultimately own or control a company, even if the legal paperwork names someone else. In many jurisdictions, particularly offshore ones like Curaçao, disclosing UBOs is either not required, not enforced, or hidden behind layers of shell companies and nominee directors.

The CGA had this information on file—but it was never made public. The breach effectively bypassed the regulator’s discretion and revealed what many had long suspected: the public-facing paperwork rarely matched the true ownership structure.

For context, in a traditional corporate registry, a company can list a trust office or a law firm as its registered agent. The public can see who the agent is, but not necessarily who controls the company. In Curaçao, this has allowed gambling operators to stay effectively anonymous while serving millions of players worldwide.

Case Study: Stake and the $1 Billion Owner Mystery

One of the most prominent names in the leaked files is Stake, a major crypto-friendly online casino and sportsbook. The license is held by a Curaçao-based entity called Medium Rare NV. The official owner listed on file is Mladen Vuckovic, a Serbian national. According to records filed with the CGA, Vuckovic reported more than $1 billion in assets in 2024.

At first glance, this might suggest that Vuckovic is the sole controlling figure behind Stake’s Curaçao operations. But internal CGA audit notes tell a more complex story. Officials reportedly questioned whether Vuckovic truly controlled the company alone. Their audits uncovered significant loans, payments, and financial flows between entities and individuals linked to Ed Craven and Bijan Tehrani, the founders of Stake.

Neither Craven nor Tehrani is named as an owner or officer on the license application. Yet the financial trail suggests their involvement in the company’s operations, funding, or profit-sharing structures. The CGA noted this discrepancy but did not deny or revoke the license.

This is exactly the kind of scenario that has critics of offshore gambling regulation worried: a license can be issued to a “paper owner” while the real beneficiaries remain hidden behind legal and financial layers. It’s not evidence of illegality, but it raises serious questions about due diligence, anti-money laundering compliance, and regulatory oversight.

Case Study: 1xBet Faces Renewed Ownership Questions

Another major operator highlighted in the leaked files is 1xBet, one of the most controversial gambling brands in the industry. The company is linked to the Curaçao entity Marikit Holdings or similar corporate structures, depending on the paperwork.

In the leaked records, the owner and CEO is listed as Ihor Hniedash. However, for years, public reporting and industry speculation have linked 1xBet to a network of individuals, including Roman Semiokhin, Dmitry Kazorin, and the late Sergey Karshkov. These names have appeared in connection with the company’s operations, licensing, payment processing, or marketing activities, though they were never officially listed as owners.

FTM reports that CGA assessors themselves suspected 1xBet had multiple owners and requested additional information about the relationship between Hniedash and the other publicly associated individuals. Despite these concerns, 1xBet still received a Curaçao license in 2024. The decision to grant a license despite unresolved ownership questions has reignited criticism that the regulator prioritizes revenue over compliance.

For regulators, ownership transparency isn’t just about knowing who’s who. It’s about enforcement. If a company is found to be involved in criminal activity, fraud, or money laundering, regulators need to know exactly who to hold accountable. With obscured ownership, enforcement becomes nearly impossible.

Case Study: Blaze.com and the Dutch Connection

The leaked files also shed light on Blaze.com, a popular online casino, particularly in Brazil and Latin America. The operator behind the brand is Prolific Trade NV, another Curaçao-based company.

According to the documents, the owners of record include Nick van Gorsel, a Dutch national, and Nicholas Beugg, an American. The case is noteworthy because it shows how easily foreign nationals can set up and operate gambling businesses under a Curaçao license, even when they are based in countries with stricter regulatory regimes.

Blaze has faced scrutiny in multiple jurisdictions due to its aggressive marketing, particularly on social media and through influencers. The leaked papers don’t allege any illegality, but they do underscore how Curaçao serves as a gateway for operators who might struggle to obtain licenses in their home countries.

Curaçao’s Regulatory Reform: Too Little, Too Late?

The breach comes at a pivotal moment for the Curaçao gambling industry. In 2024, the jurisdiction implemented a major overhaul of its gambling laws, replacing the decades-old framework that relied heavily on a small number of private master-license holders. Under the old system, these master-license holders could issue sub-licenses to other operators with minimal oversight, creating a sprawling and largely unregulated ecosystem.

The new framework is intended to centralize control under the CGA, introduce stricter anti-money laundering rules, and require more transparent reporting of ownership structures. In theory, this should address many of the problems exposed by the breach.

However, the CGA has acknowledged that during the transition, some licenses were still issued with unclear ownership structures. Companies have been granted time to meet the new requirements, effectively legitimizing a gray period. This has drawn criticism from transparency advocates who argue that reform without enforcement is merely cosmetic.

The breach also highlights a deeper issue: the regulator’s own systems were vulnerable to simple identity fraud. Even if the new laws are strong on paper, they are meaningless if the regulator cannot verify the identity of applicants or protect its own data.

What Else Is in the Data? Platino Casino and SoftSwiss

According to Wittmann, the leaked material includes additional documents related to Platino Casino and SoftSwiss, a major software provider in the gambling industry. While detailed findings on these entities have not yet been fully published, their inclusion in the leak suggests that the full scope of the exposure has yet to be revealed.

SoftSwiss is particularly interesting because it acts as a platform provider for hundreds of smaller casinos. If its involvement in licensing or ownership structures is revealed, it could have downstream implications for a wide range of operators.

For now, the investigation remains ongoing, and more stories may emerge in the coming weeks.

The Pattern: Wittmann’s History of Shaking Up Gambling Regulators

This is not Wittmann’s first time exposing regulatory vulnerabilities in the gambling sector. She previously claimed responsibility for a breach involving Malta’s gaming regulator, which also resulted in the release of internal documents and sparked legal action.

In that case, her disclosures raised questions about how seriously Malta—another major offshore gambling hub—takes data protection and regulatory oversight. Legal challenges followed, with some parties attempting to block publication of the leaked materials.

Wittmann’s actions have sparked a broader debate about the ethics of hacking in the public interest. While her methods violate laws in many jurisdictions, supporters argue that her work serves the public good by exposing systemic failures that put consumers at risk, facilitate financial crime, and enable opaque business practices.

Critics, on the other hand, point out that the leak includes personal data—passports, tax information, and financial records—of real people. Even those associated with legally operating businesses may face privacy violations, identity theft risks, or personal harm.

What Does This Mean for the Future of Offshore Gambling?

The Curaçao leak is more than a scandal; it’s a wake-up call. For years, offshore jurisdictions like Curaçao and Malta have built their gambling industries on a promise: lower taxes, faster licensing, and, implicitly, less scrutiny. This model has been successful precisely because it offers what more regulated markets do not—privacy and flexibility.

But with growing international pressure around anti-money laundering, consumer protection, and beneficial ownership transparency, that model is becoming increasingly untenable. International bodies like the Financial Action Task Force (FATF) have pushed for greater transparency, and jurisdictions that fail to comply risk being grey-listed or facing economic sanctions.

This breach demonstrates that opacity is not just a regulatory problem—it’s a security problem. If the regulator cannot protect its own files, how can it be trusted to oversee hundreds of gambling companies?

The industry itself may also face consequences. Operators whose ownership structures are now public may face legal challenges in other jurisdictions, be denied banking relationships, or find it harder to obtain licenses elsewhere. The reputational damage alone, especially for major brands like Stake and 1xBet, could be significant.

Conclusion: The Era of Hidden Ownership Is Ending

The Curaçao casino leak has revealed what many suspected but could not prove: that the offshore gambling industry is built on a foundation of hidden ownership, weak oversight, and regulatory gaps. The breach exposes not just the individuals behind certain brands, but also the institutional failures that allow such opacity to persist.

For players, the practical takeaway is to consider where and how your money is being handled. If a casino’s ownership is unclear, its accountability is equally uncertain. For regulators, the message is starker: without robust verification and data security, licensing systems are meaningless.

And for the broader industry, the writing is on the wall. Hidden ownership, private licensing, and offshore secrecy are no longer viable long-term strategies. The question now is whether jurisdictions like Curaçao will reform fast enough—or whether the next breach will bring even more skeletons out of the closet.