A major data breach at the Curaçao Gaming Authority (CGA) has revealed the details of hundreds of people associated with online gambling firms registered on the Caribbean island.
Nine-Month CGA Breach Uncovers Offshore Casino Ownership Records
The investigation, led by Dutch publication Follow the Money (FTM), operating as Casino Secrets, sifted through tens of thousands of documents from the regulator’s licensing system. The material included ownership declarations, license applications, regulatory assessments, passports, tax information, and financial records.
A Berlin-based cybersecurity researcher Lilith Wittmann, claims responsibility for the breach. According to the report, she registered through the regulator’s licensing portal under the name of a trust-office manager and gained entry to the CGA system for some nine months.
Wittmann allegedly used her personal Gmail account on behalf of a fictitious DreamCatcher Private Foundation. Within days, access was granted, and software was uploaded to the portal to gain more widespread access to its contents.
FTM said its review identified some 800 owners linked to nearly 650 licensed gambling firms. The probe also confirmed 897 records of ultimate beneficial owners for 767 persons in 646 entities.
The records reveal new details about companies whose ownership has often been difficult to confirm through public corporate registers.
There is Stake, for one. Medium Rare NV is the Curaçao entity, with Serbian national Mladen Vuckovic listed as its owner. Records filed with the CGA show he had more than $1 billion in assets in 2024.
CGA officials, however, questioned whether Vuckovic alone controlled the company. Their audits reportedly turned up large loans and payments involving businesses and individuals linked to Stake founders Ed Craven and Bijan Tehrani. Neither founder was named as an owner on the license application.
The files raise questions over 1xBet as well. The gambling brand is associated with the Curaçao company, the owner and CEO of which is named as Ihor Hniedash. Roman Semiokhin, Dmitry Kazorin and the late Sergey Karshkov have all been publicly associated with 1xBet.
FTM says CGA assessors suspected 1xBet had multiple owners and sought more information about the relationship between Hniedash and those publicly associated with the business. Yet, the company received a Curaçao license in 2024.
The FTM’s findings also contain information about other operators. That company is Prolific Trade NV, a Curaçao-based company that owns Blaze.com and whose owners are said to include Dutch national Nick van Gorsel and American Nicholas Beugg.
The investigation has brought renewed scrutiny to Curaçao’s regulatory system, which saw major changes in 2024. The new framework replaced a decades-old framework largely based on private master-license holders.
CGA acknowledged that some licenses were issued with ownership still up in the air. Companies are being given time to fulfill the requirements of the new legislation during the transition, the regulator said.
There could be more disclosures, Wittmann said. These reportedly include material on Platino Casino and software provider SoftSwiss.
The breach follows months after Wittmann took credit for another breach involving Malta’s gaming regulator. It also sparked legal action and controversy over remarks she made about the gambling industry.