The Curaçao Gaming Authority has confirmed unauthorised access to its online licensing portal on 17 September, raising concerns about the exposure of beneficial ownership data across its entire operator register. While the CGA states the breach has been contained, the full scope of compromised information remains unknown.
A grey-hat hacker identifying as Lilith Wittmann has claimed responsibility for the breach, though the CGA has not officially named her. According to Wittmann, she has maintained access to the portal since December 2025, approximately nine months, and intends to publish the complete Ultimate Beneficial Owner (UBO) list publicly.
Journalists working on the “Casino Secrets” investigation have already verified 897 UBO records spanning 646 licensed entities, suggesting the breach has exposed substantial ownership data across the Curaçao licensing framework.
Why This Matters for Operators
Curaçao remains one of the most widely used licensing jurisdictions in the iGaming industry, with hundreds of online casino and sports betting operators holding licenses under its framework. The exposure of UBO information could have significant implications for operators who have relied on the jurisdiction’s historically discreet approach to beneficial ownership disclosure.
For B2B vendors and platform providers, the breach raises questions about the security standards maintained by licensing authorities and the potential downstream effects on their operator clients. Companies whose ownership structures have remained private may now face unwanted scrutiny from regulators, competitors, or the public.
Regulatory and Compliance Implications
The timing of this breach comes as the iGaming industry faces increasing pressure for transparency around beneficial ownership. Multiple jurisdictions have tightened UBO disclosure requirements in recent years as part of anti-money laundering and responsible gambling initiatives.
While UBO registers are becoming more common in regulated markets, the unauthorised publication of such data from a licensing authority represents a significant breach of trust. Operators may need to reassess their licensing strategies and consider how exposed ownership information could affect their standing in other jurisdictions.
What Happens Next
The CGA has not provided details on how the breach occurred, what security measures failed, or what steps are being taken beyond containment. The authority also has not confirmed whether it will attempt to prevent publication of the compromised data or what support it will offer to affected licensees.
For operators and platform providers working with Curaçao-licensed entities, the immediate priority will be understanding which specific records have been compromised and preparing for potential public disclosure. The incident is likely to accelerate existing conversations within the industry about licensing jurisdiction diversification and data security standards at regulatory bodies.
