Curaçao Regulator Breach Exposes Murky Ownership Behind Hundreds of Licensed Casinos

The Curaçao Gaming Authority's acknowledgment of a significant data breach last week has triggered wider scrutiny of how the Caribbean jurisdiction vets operator ownership and financial backing. German cybersecurity researcher Lilith Wittmann disclosed that she and collaborators maintained unauthorized access to CGA systems for nine months, obtaining internal licensing files, tax records, and financial documents that detail the ownership structures of nearly 650 licensed gambling companies operating thousands of websites.

The leaked materials have already cast doubt on public narratives surrounding prominent operators. Stake, co-founded by well-known cryptocurrency gambling entrepreneurs Ed Craven and Bijan Tehrani, is officially registered in Curaçao under Serbian national Mladen Vuckovic. However, regulatory assessments obtained through the breach suggest CGA officials questioned whether Vuckovic was the genuine sole owner, noting tens or potentially hundreds of millions in payments flowing from Stake's Curaçao entity to companies and individuals connected to Craven and Tehrani-neither named in license applications.

Similarly, 1xBet, the offshore gambling giant historically associated with Russian founders, lists Ukrainian national Ihor Hniedash as owner of the Curaçao-based operating company. CGA assessors documented suspicion that 1xBet had "multiple owners" and requested clarification on Hniedash's relationship to the Russians publicly linked to the brand. The regulator granted the license in 2024 without resolving those questions.

Wittmann gained initial access by impersonating a trust-office manager, using a fictitious company to register on the CGA portal. Within days, she uploaded software granting full system control. The breach itself highlights a foundational tension in Curaçao's regulatory model: the jurisdiction has historically operated a "light touch" approach designed to attract offshore operators serving markets where they lack local licensing. That model-built around opacity and trust-office intermediaries-remained embedded in practice even as Curaçao formally transitioned away from its old sub-licensing structure under pressure from the Netherlands.

CGA officials told investigators they did not immediately deny licenses when questions surfaced because the regulator was navigating that transition. The logic is technically defensible but operationally concerning: it suggests a grace period during which material compliance gaps received tolerance rather than resolution.

Wittmann has signaled additional disclosures involving software provider SoftSwiss and alleged connections to hundreds of unlicensed casinos, as well as a purported EUR 250 million German tax loophole involving Platin Casino. These teased revelations carry weight given the documented accuracy of her initial findings regarding major operators.

Curaçao has long served as home base for operators targeting European, Asian, and Latin American players. CasinoAdvisor data suggests the jurisdiction licenses roughly 650 distinct gambling companies managing multiple brands and domains. The breach, combined with formal regulatory acknowledgment of access lapses, raises systemic questions about documentation integrity and ownership verification processes. Pending details from the forensic investigation may determine whether the CGA can credibly enforce its reformed regulatory framework or whether the jurisdiction's reputation for opacity has deeper structural roots.