Curaçao licensing leak: what the Casino Secrets documents are said to show

A Berlin-based security researcher held an account on Curaçao's gambling licensing portal for about nine months, and the documents taken from it are now the basis of an investigation published across five European newsrooms. The reporters say the files identify roughly 800 owners behind nearly 650 licensed companies. The regulator says it cannot yet confirm what was taken, disputes the conclusions drawn about its licensing, and has reported the access as a serious breach. A first follow-up, on 1 October, traced a leaked contract to a British supplier owned by three of the country's biggest bookmakers. We have not seen the documents: where a brand is named below, the claim is the reporters' and the company's reply sits beside it.

What happened, and over what period

The investigation, published on 22 September 2026 under the name Casino Secrets, was coordinated by the Dutch outlet Follow the Money with NRK in Norway, NDR in Germany, Jetzt in Austria and SVT in Sweden. Its source is a set of tens of thousands of confidential documents taken from the licensing portal of the Curaçao Gaming Authority, the regulator usually shortened to CGA. The researcher who took them, Lilith Wittmann, works on security research and is based in Berlin.

One apparent contradiction in the early coverage is worth clearing up. Some reports dated the breach to December 2025, others to September 2026. Both are right: the CGA's account is that the access ran for roughly nine months, from December 2025 until it was shut off in mid-September. December is when it started; September is when it was found.

What the reporters say the files show

The central claim is about ownership, and it is a counting exercise. These are the investigation's own figures, none of them confirmed by the regulator:

The sharper allegation is about process rather than people. Follow the Money writes that the regulator "routinely granted licences without establishing whether the declared owners were actually in charge", and did so "despite applicants failing to provide important information". Marcel Pheijffer, the accountancy academic the investigation quotes on the point, puts it plainly: "In the Dutch context, that approach would not be possible." Follow the Money also states openly that its material was obtained by hacking, and argues the public interest justified publishing it.

The four brands the reporting names

The investigation does name companies, and some of the brands behind them are among the best known in offshore gambling. We list four, at the level of the brand and of the Curaçao company the reporters say holds its licence. We leave out the individuals the files are said to identify and the wealth they declared: that is personal data taken from a hacked portal, and nothing in this story depends on it.

One of those four lines does not rest on the leak at all. The Dutch regulator, the Kansspelautoriteit, announced on 10 March 2026 that it had fined Novatech 24,846,000 euros for offering Qbet.com and 55Bet.com to players in the Netherlands without a licence, and called it a record. That is a published decision, read on the regulator's own site, and it is the only sanction among the four we could confirm at source. Everything else in the table is the reporters' account of documents we have not seen, and Follow the Money quotes no answer from the Curaçao regulator on any of the four cases individually.

What the regulator says

The CGA has not accepted the reading of its licensing. On the documents themselves it said it "does not find it prudent to draw conclusions on its licensing process by looking at separate documents and not considering the whole context of the particular applications". It did, however, confirm the substance of the transition point: under the national ordinance that took effect in 2024, it says, "it was decided not to implement all requirements at once, but to give companies the opportunity to comply". That is an acknowledgement that licences were issued while some requirements were still being phased in.

On the breach, the regulator's account is narrower than the headlines. It says an account was created using a variation of a real person's name together with an existing company registered with the Curaçao Chamber of Commerce, and that the entry point was the customer-facing part of the portal rather than the systems behind it: "The investigation has not identified a compromise of its core technical infrastructure." It has reported the matter as a serious breach under Curaçao law, commissioned a forensic investigation through its service provider, and says it has strengthened security on both the back office and the customer-facing side. It will not put a number on what was taken, saying it will not publish figures it cannot verify. The portal holds licensing applications, business information, personal history declarations and beneficial-ownership documents.

The objection from inside the industry

The Curaçao Online Gaming Association, the local operators' body, attacked the story from a different direction, and its objection is worth recording because it is mostly absent from the international coverage. COGA rejected the description of the access as ethical hacking, calling it "unauthorized entry into a restricted environment and the acquisition of confidential information" and comparing it to breaking into a secured location. It was also critical of the regulator and its technology supplier, saying "a higher and more professional level of security should have been expected". On the reporting, it argued that the coverage "insufficiently distinguishes between individual operators and the wider regulated industry" and "too readily associates Curaçao's sector with money laundering, player fraud and illegal gambling". It warned that publishing personal details could create risks for companies and individuals accused of nothing at all.

The court ruling that is really about Malta

The part of this story with a decided outcome concerns a different regulator. On 10 September 2026, Berlin Regional Court II ruled in a case brought against Wittmann by the Malta Gaming Authority and its chief executive, Charles Mizzi, over a separate breach of the MGA's systems in March 2026. The court allowed her to keep using the Malta documents and treated her description of that regulator as a permissible expression of opinion rather than a false statement of fact. It still bars her from accessing the MGA's systems again. She had been facing up to 250,000 euros or six months' detention over an earlier injunction, and the reporting puts her legal costs at 15,000 to 20,000 euros. The MGA has not commented publicly on the judgment.

The distinction matters for anyone reading the Curaçao story as settled. The Berlin judgment concerns the Malta dataset, not the Curaçao one. No court has ruled on the Curaçao documents, and the CGA's own investigation into how they were taken is still open.

Nine days on: a UK supplier's contract

The first follow-up to use the files came from the Guardian on 1 October, and it moved the story from Curaçao to Britain. Among the leaked documents, the paper reported, is a contract dated 11 October 2022 between Sports Information Services, the British supplier of racing pictures and betting data known as SIS, and Santeda International B.V., the Curaçao company behind the Mystake brand. In return for its racing channels and data on five Santeda-run sites, SIS took 18% of the gross gambling revenue on its racing products and 13% on esports. The contract ran for two years and renewed itself unless either side cancelled.

It made headlines because of who owns SIS. These are the shareholdings as NEXT.io reported them:

• Entain, the owner of Ladbrokes: 23.4%
• evoke, the owner of William Hill: 19.5%
• Betfred's owner Fred Done and the Tote, together: 13.5%

Added up, that is 56.4%: the groups behind three of Britain's best-known high-street bookmakers hold more than half of the supplier between them. The same reporting says SIS paid its shareholders a 30 million pound special dividend in 2023, and that its racing feed could still be watched on Santeda sites from a UK internet address as recently as spring 2026. Santeda has been accused in earlier Guardian reporting of targeting British customers without a licence, including through affiliate sites aimed at people who had self-excluded, and has been fined in Spain for operating without one.

SIS did not confirm whether the deal is still running. It said every customer agrees to "only offer SIS products where it is legal to do so", and that where those terms are broken it takes "corrective action to enforce the position, up to and including suspension or termination of contracts". Entain said it is "not a party to the commercial or customer arrangements SIS decides to strike" and has "raised our concerns to SIS". The Betting and Gaming Council said SIS is not a member and that its commercial relationships "are a matter for SIS". Evoke and Fred Done had not responded when the reports appeared. For the question this article keeps returning to, what a Curaçao licence tells you, the contract adds one point: a licensee's business partners are not only offshore, and on the reporting's account a supplier owned by licensed British firms was paid a share of what players lost on offshore sites.

What is confirmed and what is not yet known

• Confirmed: there was unauthorised access to the CGA's licensing portal from December 2025 until the middle of September 2026; the CGA told licensees on 17 September and has reported it as a serious breach; the investigation was published on 22 September by five newsrooms; the CGA says not all licensing requirements were applied at once during the 2024 transition; a Berlin court ruled on 10 September that Wittmann may continue using the separate Malta material; and, separately from the leak, the Dutch regulator fined Qbet's operator 24,846,000 euros on 10 March 2026.
• Not known: what was actually taken, which the CGA says it cannot yet verify; whether any individual owner or company did anything unlawful, which the documents on their own do not establish; what the CGA's forensic investigation will conclude; whether any regulator will act on the ownership questions about Stake, 1xBet or anyone else; whether the SIS contract with Santeda is still in force, which SIS has not said; and whether any court will rule on the Curaçao files.

What it means for players

The practical lesson is about what a licence number actually certifies. A Curaçao licence is a permission granted to a company, under a regime the regulator itself describes as having been phased in rather than applied all at once. It is not, and has never been, a consumer-protection scheme of the kind a national regulator runs: there is no central complaints route to escalate a dispute to, and no shared self-exclusion register behind it. A licence seal in a site footer tells you a company obtained a permission; it does not tell you who controls the company, which is precisely the gap the reporters say the files expose.

The checks that do work are unglamorous: whether the terms name a company and an address, whether withdrawal limits and verification rules are written down before you deposit, and whether a regulator's own register lists the licence rather than only a badge in the footer. None of this is legal advice, and no reader needs to take a view on allegations that have not been tested.

Frequently asked questions

Sources

1. Follow the Money - Curaçao's secretive gambling industry exposed in leak (22 September 2026)
2. iGaming Expert - Curaçao Gaming Authority reveals details of security leak (24 September 2026)
3. Flexi-News - Curaçao Gaming Authority says licensing portal was accessed for nine months using a false identity (25 September 2026)
4. Curaçao Chronicle - COGA criticises the CGA portal breach and the international reporting (24 September 2026)
5. Well Played - Berlin court ruling clears Casino Secrets hacker over MGA (28 September 2026), on the judgment of 10 September 2026
6. Kansspelautoriteit - Twee boetes voor illegaal aanbod, waaronder recordboete van 24 miljoen (10 March 2026)
7. NEXT.io - SIS deal with black-market Santeda sparks rift with shareholder Entain (1 October 2026), on the Guardian's report of the same day
8. Bitcoin.com News - 'Casino Secrets' leak ties UK bookmakers to offshore Mystake operator (2 October 2026)
9. The Gamblest - SIS faces scrutiny over Curaçao gambling deal (2 October 2026)
10. Curaçao Gaming Authority - official site (the authority's words above are quoted as reported, not from a statement we opened)