The global online gambling industry is facing a monumental transparency crisis following the disclosure of a massive data breach at the Curaçao Gaming Authority. German cybersecurity researcher and self-proclaimed white-hat hacker Lilith Wittmann revealed that she and a team of collaborators successfully infiltrated the internal systems of the Caribbean-based gambling regulator, maintaining unauthorized access for a period of nine months. The breach, which was officially acknowledged by the Curaçao Gaming Authority (CGA) in mid-September, has blown the lid off long-standing suspicions regarding opacity, shell corporations, and regulatory oversights within the jurisdiction.
Working in tandem with Dutch investigative journalism outlet Follow the Money (FTM), Wittmann’s prolonged digital residency inside the regulatory infrastructure exposed sensitive files, including license applications, detailed regulatory assessments, passport copies, tax returns, and comprehensive financial histories. The leaked information has cast a harsh spotlight on the ownership structures of several industry giants, including Stake and 1xBet, while igniting broader discussions regarding the efficacy of Curaçao’s recent regulatory overhaul.
The Anatomy of the Infiltration: A Masterclass in Social Engineering
The security lapse at the Curaçao Gaming Authority underscores profound vulnerabilities in how remote jurisdictions process and vet online gambling operators. Wittmann, a 30-year-old Berlin-based security researcher who previously targeted the Malta Gaming Authority (MGA), managed to bypass regulatory defenses with startling simplicity.
According to reports from Follow the Money, Wittmann gained access to the CGA’s digital portal by registering under the name of a trust-office manager already familiar to the regulatory body, while purposefully utilizing her own standard Gmail address. Operating under the banner of a fictitious corporate entity named the "DreamCatcher Private Foundation"—a shell organization she fabricated specifically for the test application—Wittmann successfully secured administrative access to the regulator’s internal portal within a matter of days.
Once inside, she uploaded custom software that allowed her and her collaborators to establish permanent operational control over the licensing system. For nine months, the hackers observed the inner workings of the regulatory body in real time. Wittmann described the experience on social media, noting that without the employees’ knowledge, she could view the hidden owners of illegal online gambling operations, track their financing, and evaluate the precise extent of the authority’s internal awareness regarding these illicit networks.
Chronology of the Disclosure and Regulatory Fallout
The sequence of events leading to the public unravelling of the Curaçao gaming scandal began internally months before the public acknowledgment:
- Late 2023 to Early 2024: Lilith Wittmann and her collaborators initiate their breach of the Curaçao Gaming Authority portal using the fictitious DreamCatcher Private Foundation credentials.
- Throughout 2024: The hackers maintain uninterrupted access to internal communications, financial records, license applications, and regulatory notes, observing the processing of various high-profile gambling licenses.
- September 17, 2024: The Curaçao Gaming Authority publicly acknowledges an unauthorized data access incident, stating that it has successfully contained the breach, identified the source, and launched an ongoing forensic investigation.
- September 22, 2024: Lilith Wittmann publicly claims responsibility on social media platform X, detailing the nine-month infiltration. Simultaneously, Dutch investigative platform Follow the Money publishes a comprehensive exposé detailing the leaked documents.
- Late September 2024: Broader revelations emerge concerning Platin Casino, SoftSwiss, and lingering questions regarding the true beneficiaries behind major global betting brands.
The CGA responded to the breach by emphasizing that containment protocols were enacted immediately upon discovery. However, the regulator conceded that a comprehensive forensic investigation remains underway, meaning the full scope of exfiltrated data and compromised communications has not yet been fully quantified.
Scrutiny Intensifies Over Stake and 1xBet Ownership Models
The leaked files have provided tangible evidence supporting long-held industry rumors that the public-facing leadership of certain prominent online gambling brands may differ significantly from their ultimate beneficial owners. Two specific corporate entities, Medium Rare NV (operating Stake) and Caecus NV (operating 1xBet), have drawn intense scrutiny from both investigators and the regulator’s own internal assessors.
The Stake Transparency Puzzle
Stake has risen to become a dominant force in the global crypto-gambling sector, heavily promoted by high-profile founders Ed Craven and Bijan Tehrani. However, regulatory documentation filed in Curaçao presents a different narrative regarding corporate control.
According to Follow the Money, Medium Rare NV—the Curaçao-registered company behind Stake—is officially owned by Mladen Vuckovic, a Serbian national who serves as the company’s chief executive officer. In financial disclosures submitted to the regulator in 2024, Vuckovic declared personal assets exceeding $1 billion.
Despite these filings, internal CGA assessors expressed deep skepticism regarding whether Vuckovic was truly the sole economic beneficiary of the enterprise. Documents uncovered in the leak revealed substantial loans and financial transfers valued in the tens and hundreds of millions of dollars. These funds flowed from Medium Rare NV to various corporate entities and individuals closely linked to Craven and Tehrani, neither of whom appeared on the official licensing documents submitted to the regulator.
The 1xBet Corporate Web
A similarly complex ownership structure surrounds 1xBet, an offshore betting behemoth historically associated with Russian founders Roman Semiokhin, Dmitry Kazorin, and the late Sergey Karshkov, who passed away in 2023.
Despite these well-documented historical ties, official paperwork submitted to the Curaçao Gaming Authority lists Ukrainian national Ihor Hniedash as the owner and CEO of Caecus NV, the corporate vehicle holding the 1xBet Curaçao license. Internal assessments show that CGA evaluators actively suspected 1xBet of maintaining "multiple owners" and formally requested clarification regarding Hniedash’s precise business relationship with the Russian founders.
Despite these unresolved inquiries and unanswered questions, records indicate that the regulator ultimately granted Caecus NV an operating license in 2024. When questioned about this decision, representatives for the CGA explained that the authority did not automatically reject applicants whenever uncertainties arose, citing the complex transitional phase of Curaçao’s broader regulatory reform.
Curaçao’s "Light Touch" Legacy and the National Reform Pressure
For decades, the Caribbean island of Curaçao functioned as an incubator for the online gambling industry, operating under a notoriously relaxed "light touch" regulatory framework. This model allowed thousands of online casinos to launch rapidly, frequently serving international jurisdictions where the operators held no local licenses. Corporate ownership was routinely obscured behind localized management companies, trust offices, and obscure legal structures.
Under intense political and economic pressure from the Netherlands—its primary constitutional partner in the Kingdom of the Netherlands—Curaçao initiated a legislative overhaul designed to replace the old sub-licensing model. Historically, this legacy system allowed a handful of private master-license holders to sublicense their regulatory authority to countless individual operators with minimal direct government oversight.
The new framework was intended to establish rigorous, centralized supervision through the Curaçao Gaming Authority. However, the leaked documents compiled by Follow the Money and exposed by Wittmann suggest that the transition has been marred by internal administrative compromises. The files indicate that regulatory officials routinely approved new licenses even when internal reviews flagged unresolved questions regarding ultimate beneficial ownership, financial provenance, and potential compliance red flags. In total, the leak facilitated the identification of approximately 800 individual owners operating nearly 650 licensed gambling companies that collectively manage thousands of active websites.
Broader Implications: Software Providers and Tax Loopholes
Beyond individual operator scrutiny, the breached documents point to systemic vulnerabilities across the broader iGaming supply chain. Wittmann has teased upcoming disclosures involving a staggering €250 million tax loophole allegedly tied to Platin Casino, which the researcher characterizes as Germany’s largest illegal online casino operation.
Furthermore, the leaked files reportedly detail extensive operational ties between software provider SoftSwiss and numerous corporate entities running hundreds of offshore gambling websites. These revelations are expected to draw the attention of European tax authorities, financial intelligence units, and regulatory bodies in jurisdictions where these white-label and platform providers operate without localized authorization.
The data leak also highlights the ongoing tension between traditional regulatory bodies and modern cybersecurity researchers. While mainstream authorities view unauthorized network infiltration as a severe criminal offense—exemplified by the Malta Gaming Authority securing a preliminary German court injunction against Wittmann following a similar breach earlier this year—hacktivists and security advocates argue that aggressive transparency measures are necessary to expose institutional negligence and links to organized crime.
Industry Outlook and Accountability
As the Curaçao Gaming Authority presses forward with its forensic investigation and attempts to secure its digital infrastructure, the broader online gambling sector is forced to reckon with an unprecedented level of exposure. The incident has permanently altered the landscape of regulatory accountability, demonstrating that even secretive offshore jurisdictions are vulnerable to sophisticated digital audits.
For operators, the breach signals an era where obscured ownership structures, complex intermediary loans, and nominal front-facing executives can no longer guarantee corporate anonymity. For regulators, the fallout serves as a stark warning that administrative backlogs and lax vetting procedures will face public exposure, whether through official investigative journalism or unauthorized digital whistleblowing. As Wittmann continues to analyze and release findings from the massive data cache, the pressure on international regulators to enforce genuine compliance and transparency has never been greater.
