Curaçao investigates gambling hack: what happens to the leaked files and disputed licences? 

On 17 September, the Curaçao Gaming Authority (CGA) reported that someone had gained unauthorised access to its online gambling portal. At the time, the regulator said it did not yet know what information had been accessed. Five days later, Follow the Money (FTM) published findings based on tens of thousands of documents obtained through that system. 

The story has therefore become bigger than a security incident. The documents contain sensitive information about the people behind gambling companies, as well as internal assessments in which CGA staff raised questions about ownership and the source of funds. According to FTM, some companies were nevertheless granted a licence. The question now is how the CGA will deal with both issues: who will be informed about the compromised data, and will the licences concerned be reviewed? 

What did the CGA say about access to its portal? 

In its statement of 17 September, the CGA confirmed that unauthorised access to the online portal had taken place. According to the regulator, that access had been blocked and its source had been identified. An external service provider had begun a digital forensic investigation into exactly what had happened. 

At that point, the CGA was still unable to determine which information had been accessed and what the consequences might be. The regulator also stated that the investigation had so far found no evidence that its core technical infrastructure had been compromised. However, that does not establish whether documents in the portal were viewed or taken: that was precisely the question the investigation still had to answer. 

The CGA promised to inform individuals, applicants, licence holders and other parties directly if the investigation shows that their data may have been affected. It also announced additional checks and security measures. The statement did not yet specify how many files had been affected, which parties had been notified or when a further update would follow. 

Researchers examined thousands of confidential documents 

The investigation published by FTM on 22 September provides a more concrete picture of the information that became accessible through the system. According to FTM, German cybersecurity researcher Lilith Wittmann gained access to the licensing portal at the end of 2025 and obtained tens of thousands of documents. The investigative platform analysed those files together with international media partners under the name Casino Secrets. 

According to FTM, the documents relate to 646 gambling companies holding a Curaçao licence. They include licence applications, names of ultimate beneficial owners, corporate structures, passports, tax information and financial statements. FTM used documents obtained by Wittmann in December 2025 for its investigation. That is also the reference date for its findings concerning the licences. 

This materially changes the public discussion. On 17 September, the CGA was still investigating what data might have been accessed. A few days later, FTM described the types of confidential documents that researchers had actually received and analysed. This does not mean that every affected individual or company is now known, or that all those documents have been made publicly available. It does, however, show why clarity about the scale of the incident is urgently needed. 

Who needs to be informed? 

A licensing portal contains far more than company names and domain names. Applicants must provide information that allows a regulator to assess their identity, financial position and suitability. According to FTM, the documents it examined also included passports and tax information. Such documents may relate to owners, directors and other individuals involved. 

In its initial statement, the CGA said it would inform affected parties if the investigation finds that their information may have been compromised. Based on that statement, it is not yet possible to determine publicly who has since been notified, which data was involved in each file or what measures the regulator advised those individuals to take. A further CGA update could provide clarity on precisely those points. 

An important distinction must also be made. The fact that journalists examined the documents does not mean that all personal data was made freely accessible online. FTM says it handled the files carefully because of the sensitive information they contained. For someone whose passport or financial details appear in a compromised file, however, the question remains what happened to that data and whether others also had access to it. 

The second issue: licences with unresolved questions 

The documents also brought another issue to light. FTM examined applications and internal CGA assessments and found cases in which staff questioned information provided by gambling companies. The questions concerned, among other things, the true owners, the source of funds and possible activities in countries where a company did not have a local licence. Nevertheless, according to FTM, several files ultimately resulted in a recommendation to grant a licence, sometimes on the condition that the company would provide additional information at a later stage. 

In the case of Stake, for example, CGA staff reportedly questioned whether the person listed as the owner of the Curaçao entity was also its sole owner. In the case of 1xBet, reviewers wanted greater clarity about other parties who might be involved. These are questions found in internal files, not definitive findings that a declared owner was incorrect or that a licence holder had committed fraud. 

The CGA does not deny, in its response to FTM, that it granted licences while some uncertainties remained. The regulator points to the transition from Curaçao’s old licensing system to the new rules. According to the CGA, existing companies were given the opportunity to comply with the requirements gradually; not every outstanding question therefore had to result in an immediate refusal. 

That explanation clarifies the procedure, but raises a follow-up question: have the missing answers since been provided and assessed? The leaked files mainly show the situation as it stood in December 2025. They do not prove that the same questions were still unresolved in September 2026. Only the CGA can clarify that for each licence concerned. 

Why ownership also matters outside Curaçao 

Knowing who actually owns a gambling company is important when a regulator assesses the integrity of an applicant. It also matters if a company is found to be operating in another country without a local licence. A Curaçao licence does not automatically grant access to the Dutch or Belgian market. 

Qbet illustrates how complicated this can become. In March 2026, the Dutch Gambling Authority imposed a €24,846,000 fine on Novatech Solutions, the Curaçao-based company behind Qbet.com and 55Bet.com, for illegally offering gambling services to Dutch players. An objection has been filed against that decision. Gambling Club previously reported on the Qbet fine and the difficulties involved in collecting penalties from foreign operators. 

According to FTM, Novatech’s Curaçao file lists a Filipino woman as the ultimate beneficial owner, while CGA staff had questions about her precise role. New information about a declared owner may provide regulators or parties in legal proceedings with a new line of inquiry. On its own, however, it does not prove that the individual is personally responsible for the violations for which the company was fined. 

For Belgian readers, the distinction between a Curaçao licence and a local licence is also relevant. Gambling Club previously explained why Stake does not have a Belgian licence. Who owns an international gambling website, where the operator is based and in which country that website is legally allowed to serve players are three separate questions. 

Can a sanction reach the people behind a company? 

A name in a licensing file can help investigators examine a corporate structure. However, identifying an owner does not automatically make that person liable for the actions of the company. That depends on the facts, the legal basis and the individual’s role in a specific case. 

That distinction does not diminish the importance of clear ownership information. Gambling Club previously described how Lalabet continued under a different name following legal pressure. When brands, domains or operators change, regulators need to be able to determine which individuals and companies remain involved. The Lalabet case is unrelated to the CGA documents that have now been leaked, but it illustrates why investigations into the structure behind a gambling website need to go beyond the name displayed on its homepage. 

There is also the practical side of enforcement. Imposing a fine and actually collecting the money are two different steps, particularly when companies and their assets are located outside the regulator’s country. Gambling Club previously reported on the gap between gambling fines imposed and amounts actually collected. The leaked ownership information may open new avenues for investigation, but it is no substitute for a carefully documented enforcement case. 

Which questions remain unanswered? 

Following the publication of Casino Secrets, the CGA faces two separate sets of questions. The first concerns security: which documents were accessed or taken, who was affected, and when will they be notified? The second concerns regulatory oversight: which questions about ownership were still unresolved when licences were granted, what answers were subsequently received, and is further investigation needed into some companies? 

The CGA’s initial statement promised further updates once more facts had been established. A public response to FTM’s specific findings would show how the regulator intends to follow up on the two issues. Until then, it is established that unauthorised access took place, that FTM examined confidential licensing documents and that questions concerning ownership appeared in several of the applications reviewed. What consequences this will have for the individuals concerned and for existing licences has not yet been publicly established.