Hack exposes names behind hundreds of Curaçao-licensed gambling operators

A security breach of the Curaçao Gaming Authority's systems exposed licence applications and confidential dossiers for 646 Curaçao-licensed gambling companies, according to documents obtained by the German cybersecurity researcher Lilith Wittmann and analysed by Follow the Money (FTM) with international partners. The leaked material, which Wittmann gained access to in late 2025, includes licence applications, CGA staff assessments, corporate structures, passports, tax records and financial declarations for operators running thousands of online gambling sites.

What the Curaçao Gaming Authority hack revealed

The files give regulators and investigators a rare line‑of‑sight into who is listed on paper as an ultimate beneficial owner (UBO) of Curaçao companies that operate prominent gambling brands. FTM reports that names recorded in the dossiers include people linked to Blaze, Qbet, Stake and 1xBet. CGA reviewers flagged doubts about the veracity of declared owners or the sources of funds in multiple applications, yet licences were granted in a number of those cases.

The leaker's documents cover 646 companies that hold Curaçao licences and between them operate thousands of gambling sites. FTM examined who was recorded as the UBO in each dossier, stressing that a name on paper is a starting point for an inquiry and does not automatically prove who makes the decisions or controls funds.

Why the leaked ownership data matters for national regulators

A Curaçao licence does not authorise cross‑border operations in jurisdictions that require a local licence. National authorities in Belgium and the Netherlands still determine whether a provider may lawfully offer online gambling to residents. The leak is therefore relevant for enforcement because knowing which persons and entities are registered as owners helps national authorities pursue sanctions, civil remedies or asset recovery when they investigate illegal operations.

Belgian and Dutch enforcement agencies have faced practical obstacles when dealing with internationally structured operators: companies operating under multiple corporate names, shifting domains, and foreign registrations make it harder to identify the right legal target. The Dutch regulator, the Kansspelautoriteit, imposed a €24,846,000 fine on Novatech Solutions N.V. in March 2026 after it concluded that Qbet.com and 55Bet.com offered games to Dutch players without a Netherlands licence. The KSA described that as its largest fine at the time; the decision is under objection.

Case studies from the leaked dossiers: Blaze, Qbet, Stake and 1xBet

Blaze

FTM reports that the Curaçao dossier for Prolific Trade N.V., the company behind Blaze.com, names the Dutch national Nick van Gorsel and the American Nicholas Beugg as owners. In their 2024 licence submissions Van Gorsel declared personal net assets of €800,000,000 and Beugg declared €500,000,000; those figures come from the operators' own filings to the CGA and have not been independently verified by Gambling Club. Neither person responded to requests for comment made by FTM.

Qbet

The leaked files show the Filipina Joanna Tinaco Arenas recorded as the UBO of Novatech Solutions N.V., the Curaçao company behind Qbet. CGA staff reportedly questioned her precise role and the provenance of the funds she declared. FTM's review notes that Arenas was also employed as a manager for a Philippines‑based company that provides services to gambling operators, and CGA assessors wondered whether Qbet might function effectively as a brand of that firm. Novatech and Qbet did not provide comments to FTM.

Stake

Publicly known founders of the crypto‑casino Stake, Ed Craven and Bijan Tehrani, do not appear as owners in the Curaçao dossier analysed by FTM. Instead, the files record Mladen Vuckovic as owner of Medium Rare N.V., the company behind Stake, though CGA staff asked whether Vuckovic was the sole owner. Assessors identified payments and loans from Medium Rare to companies or individuals linked to Craven and Tehrani. The CGA nevertheless issued a licence to Medium Rare while those questions remained on file. Stake and the involved trust firm did not reply to FTM.

1xBet

FTM reports the Ukrainian Ihor Hniedash is listed as director and owner of Caecus N.V., the Curaçao company behind 1xBet. CGA reviewers wanted more clarity about Hniedash's relationships with three Russian businessmen frequently named in public reporting about 1xBet; assessors suspected there might be multiple owners. The CGA's questions reportedly remained unresolved at the time the licence was granted.

"A name on paper is a starting point, not proof of who controls a company," a forensic reviewer told FTM, urging further verification of the applications.

How the Curaçao Gaming Authority explains its decisions

The Curaçao Gaming Authority does not deny that licences were issued while queries about corporate structures or owners were unresolved, FTM says. The CGA told FTM that it opted for a staged compliance approach while the sector transitioned to a new regulatory system and that authorities gave companies time to meet updated requirements rather than immediately refusing licences or shutting down activities.

That staged approach means unanswered questions about ownership put weight on ongoing supervisory checks and follow‑up information requests. Where follow‑up material was not provided, uncertainties about actual control and financing can persist.

Implications for operators, regulators and enforcement

For national supervisors and litigation teams the leaked dossiers can provide investigatory leads: a recorded UBO is a concrete data point for subpoenas, asset tracing and civil claims. For operators and platform vendors the files underline continuing scrutiny of corporate transparency and source‑of‑fund declarations.

The leak also demonstrates practical enforcement limits: even when a national regulator imposes a sanction, collecting fines or enforcing orders against entities with cross‑border structures remains complex. For readers interested in regulatory fallout and enforcement reactions, see our coverage of broader regulation and cross‑border enforcement developments in the news and b2b sections.

The FTM analysis is based on documents Wittmann accessed in December 2025; any subsequent ownership changes or supplementary information provided to the CGA after that date are outside the scope of their review. The CGA now faces the task of demonstrating what steps it has taken since those dossiers were prepared to resolve outstanding doubts about who ultimately controls licensed operators.