Curaçao Gaming Authority breach could expose casino UBOs

Grey hat hacker Lilith Wittmann says she accessed the Curaçao Gaming Authority’s systems for months and plans to publish information on the ultimate beneficial owners of online gambling businesses. Lilith Wittmann, a German activist, has taken responsibility for the recent breach of the Curaçao Gaming Authority, saying she got access to its systems in December 2025. The breached information includes information related to casino ownership, financing, license applications, and other regulations. In the cooperation with media in several countries, she has already published some information regarding the license holders and companies that were reportedly associated with such names as 1xBet, Stake.com, SoftSwiss and Platinum Casino. Wittmann has also stated that she had intentions to publish a list of ultimate beneficial owners and their identities from online gambling companies from offshore countries. In her article published on her website, Wittmann tells how she allegedly hacked the computer system that belongs to the CGA She claims that she was able to hack the authority’s systems in a matter of hours after being granted access to the online portal of the regulator. In a LinkedIn post, Wittmann said: For nine months, I watched the Curaçao gambling authority at work in real time—without the staff knowing. I could see who owned illegal online casinos, who financed them, and what the authority knew about their operations. Today, in collaboration with NDR, NRK, SVT, and FTM, I am publishing the #casinosecrets. In a post published on her website, Wittmann described how she allegedly gained access to the CGA’s systems using a false identity. She claims that she exploited a security vulnerability within hours of accessing the regulator’s online portal, gaining access to its servers and licence-management system. According to Wittmann, this allowed her to view applications and documents submitted to the authority. There have been allegations similar to the one brought against the Malta Gaming Authority (MGA), for which Wittmann had already acknowledged her involvement. As for the details regarding the Curaçao breach and information implicated in it, it’s still unclear. Publishing UBO information may lead to additional regulatory and privacy concerns for players and people involved in the country’s online gambling sector.