Unauthorized Access to Curaçao Gaming Portal Exposes Operator Records
Published material allegedly from the portal included ownership, identity and financial documents tied to 646 licensed organizations and 767 individuals.
Unauthorized access to Curaçao’s online gaming portal exposed corporate, identity and financial records tied to hundreds of licensed gambling organizations, raising questions about ownership structures across a global betting market.
The Curaçao Gaming Authority said an account created under a false identity was used to access the portal from December 2025 until Sept. 17, 2026. The regulator said it contained the access, identified its source and found no compromise of its core technical infrastructure at that stage.
A review covered 646 organizations that held Curaçao licenses in December 2025. It manually verified 897 ultimate beneficial owner records involving 767 individuals. The review identified nearly 650 licensed companies operating thousands of gambling sites.
Published material allegedly originating from the portal included company ownership information, license applications, regulatory assessments, passports, tax returns and financial records. The journalists who reviewed the leaked records questioned whether declared owners controlled Stake and 1xBet. Those claims remain allegations based on leaked records.
German security researcher Lilith Wittmann said she first accessed the system on Dec. 3, 2025, using the name “Flip Humme.” She said she reached the licensing portal within hours and that access ended around 10:30 p.m. ET (UTC-4) on Sept. 17 after the regulator was confronted.
“I decided it was important enough for us as a society to know who owns these companies,” Wittmann said.
The Curaçao Gaming Authority said the incident was a serious breach but has not confirmed how many documents or records were accessed. It also has not said whether player data or records belonging to any particular operator were obtained.
“The full extent of the material obtained has not yet been established,” the regulator said Sept. 22.
Operators and suppliers use the portal to seek licenses and provide information required by the regulator. The jurisdiction moved online gaming under the authority’s direct oversight in 2024. Operators must obtain any additional approvals required in countries where they accept wagers.
The regulator said it would disclose what was taken only after its investigation supports those findings.
