Offshore gambling has taken a major hit: German cybersecurity researcher Lilith Wittmann hacked the government portal of the Curaçao Gaming Authority (CGA). All leaked documents were made publicly available.
The hack did not affect players of individual websites, but the regulator itself. Terabytes of confidential documents from more than a thousand casino and betting projects that applied for or renewed licenses up to 2024–2025 were made public. Among them — are global giants such as Stake and 1xBet, as well as brands popular in the CIS, including Vavada.
What exactly was made public
The archive contained all the internal documentation that companies submitted to obtain licenses:
-
Real owners: passport scans, residential addresses, bank account statements and proof of the source of funds.
-
Financial figures: reports on actual revenue, net profit, deposit volumes and business plans for years ahead.
-
Business structure: chains of legal entities, payment solutions, nominee directors and contracts with game providers.
-
Internal correspondence: notes from the regulator's inspectors who approved licenses even when questionable documents were present.
How the hack happened
There were no hacker attacks on the databases of the casinos themselves. Back in late 2025, the researcher registered an account on the regulator's website posing as a trust fund.
She found a vulnerability in the government portal and spent nine months quietly downloading the entire confidential archive. The investigation was conducted jointly with major European media outlets, including German broadcaster NDR and the Follow the Money project.
What this will lead to
The leak will become a serious problem for the entire sector:
-
Exposure of owners. Most casino owners had hidden their names behind nominees and shell companies in Cyprus for years. Now their identities and actual incomes are publicly available.
-
Attention from tax and law enforcement authorities. Tax authorities in European and other countries have obtained official financial reports from brands that accepted users without local licenses. This could lead to criminal cases and account freezes.
-
Damage to Curaçao's reputation. The island's license now looks extremely unreliable for businesses, which will almost certainly accelerate brands moving to other jurisdictions — for example, Malta, Anjouan or Kahnawake.
