On September 23, 2026, a database of more than 40,000 documents from the Curaçao Gaming Authority (CGA) — the regulator that licenses a significant share of offshore online casinos — was released to the public. A day earlier, the "Casino Secrets" investigation into the regulator's own operations had come out. The industry is already calling this Curaçaogate.
Documents can be searched by company name or domain at: https://casinosecrets.lol
How it happened
- German cybersecurity researcher Lilith Wittmann, 30, based in Berlin, gained access to CGA's systems by posing as a representative of a fictitious company, DreamCatcher Private Foundation, while filing a license application.
- Access to the regulator's internal systems lasted around nine months, starting in December 2025.
- Journalists from several outlets joined the effort to process the roughly 2 terabytes of data: the Dutch platform Follow the Money, Germany's NDR, Norway's NRK, Sweden's SVT, and Austria's Jetzt.
- On September 23, 2026, the first 40,000 documents were published on casinosecrets.lol, searchable by company name and domain.
- CGA confirmed the unauthorized access on September 17, stating that the breach had been contained, its source identified, and that a forensic investigation was ongoing.
What was found
- The documents include license applications, beneficial ownership records, passports, and tax and financial filings.
- According to Follow the Money, the material identifies roughly 800 beneficial owners linked to nearly 650 licensed companies operating thousands of casino domains.
- The investigation's key finding: a Curaçao license does not guarantee that the regulator has actually established who really owns a given casino.
- The regulator also knows exactly where its licensed casinos are operating without authorization in specific markets. Through the CGA portal's API, a new mirror domain can become "licensed" almost instantly, making it easier to circumvent local market blocks.
- By Wittmann's estimate, in 2025 players lost more than €1.75 billion at casinos run by nine Curaçao-licensed companies she links to Softswiss. Softswiss declined to comment.
- Separately, the leak points to an alleged €250 million tax shortfall in Germany connected to Platin Casino — which Wittmann describes as "Germany's largest illegal casino."
Early fallout
- On September 22, 2026, an article appeared on the site about the owner of the offshore product Platinum Casino, whose primary market was Germany. His arrest was preceded by a months-long investigation by the Frankfurt public prosecutor's office — a timeline that overlaps with the period Wittmann had access to CGA's servers.
- Around 100 police officers took part in the arrest operation, and €82 million in assets were seized.
- Wittmann previously breached the Malta Gaming Authority (MGA) in the same way and is now in litigation with Malta's regulator, which obtained a preliminary injunction against her in Germany.
- Journalists are cross-referencing the leaked data with public registries in Cyprus, Malta, and Gibraltar, with further reporting expected.
What this means for the market
Curaçaogate lowers the barrier to investigation: internal licensing data is now accessible not only to regulators and tax authorities in any jurisdiction, but to any investigative journalist. Given the scale — 650 companies, 800 beneficial owners — and the arrests already underway, more publications and targeted scrutiny of individual brands and providers should be expected in the coming weeks.
Link to Lilith Wittmann's original post on X: https://x.com/LilithWittmann/status/2102652495432712686
