Curacao’s regulator was hacked. The files show who owns the casinos

On 22 September an international investigation published what the Curacao Gaming Authority’s public register never shows: who actually owns the casinos, and what the regulator wrote down before it stamped the licence. The files come from the authority’s own licensing portal. They cover roughly 650 licensed firms, about 800 owners and more than 8,000 casino domains. Several of those firms sit on this site.

The cache is now searchable at casinosecrets.lol. The reporting ran the same day in Follow the Money, NRK, NDR, Jetzt and SVT, under the name Casino Secrets. We are not republishing passports, tax returns or share ledgers. Those belong in a newsroom with lawyers, not on a review page. What follows is what the published reporting, the regulator’s own statement and the public index of the dump actually establish, and what that does to a Curacao seal on a cashier.

What was taken, and from where

Berlin researcher Lilith Wittmann says she first logged into the CGA portal on 3 December 2025 under a false identity, using the nickname of a trust-office manager the authority already knew, and her own Gmail address. She writes that within eight hours a simple hole in the software gave her the whole licensing system. From then until 17 September 2026 she could read every application as it arrived: company extracts, ownership charts, business plans, source-of-wealth statements, passports, criminal-record extracts, the assessors’ comments and the final recommendation.

Follow the Money, which used only the December 2025 slice of that cache, puts the haul at tens of thousands of confidential documents. The Casino Secrets site itself now talks about more than 40,000 documents from the CGA, with extra files from the Malta Gaming Authority and public registers in Malta, Cyprus, Gibraltar and Curacao. The index on the site says the records run to August 2026.

Wittmann confronted the CGA at about 22:00 on 17 September. She writes that the hole was closed half an hour later. That same day the authority put out a statement, reported by the Curacao Chronicle on 18 September. It confirmed unauthorised access to the online gaming portal, said the access had been contained and the source identified, and said a forensic investigation was still trying to establish what had been viewed. It added that investigators had found no sign the core technical infrastructure was compromised, and that anyone whose data was affected would be told directly. It did not name Wittmann, and it did not confirm that files had left the building. Five days later the files were public.

What the files show about how a licence is granted

This is the part that matters more than the names.

Follow the Money had forensic accountant Marcel Pheijffer of Nyenrode read a sample of the CGA’s own assessments. Assessors kept finding holes: wealth that did not add up, owners who did not look like owners, blacklists from foreign regulators, markets the applicant was not allowed to serve. The closing line was still, again and again, that the licence may be granted. Conditions were attached. The missing answers often never came.

The CGA did not dispute that finding. In its reply to FTM it said the sector is in a transition after the 2024 rewrite of the law, and that under the finance minister it chose not to impose every requirement at once. Its stated principle is not to refuse a licence, or shut a live operation, the moment a question appears. Pheijffer called that thinking backwards. Jan van Koningsveld, who specialises in offshore structures, pointed at the same 2024 law: the regulator is supposed to establish, as far as possible, who the owners and decision-makers actually are. Concealed ownership is a money-laundering risk in any casino, and worse when the cashier runs on coins.

Wittmann’s own write-up adds the machinery behind those assessments. The portal had 26 staff accounts that look like CGA employees. A large share of the actual work sat with two contractors: Random Consulting Limited in Malta, which does the due-diligence pass, and HSJ Consult in Cyprus, which writes the suitability memo the board then stamps. Random Consulting is owned by Mario Galea, who ran the Malta Gaming Authority from 2004 to 2008. Wittmann also found a portal feature that lets a licensee attach secondary domains, with an API that can register a new one without a human at the CGA touching it. That is how a blocked address becomes a licensed address in seconds.

A Curacao licence still costs €47,450 a year, split between the finance ministry and the CGA. Wittmann puts the state’s take at about €26 million a year. There is no gambling tax on offshore play, and corporation tax only bites on income earned on the island. The companies do not earn it on the island. The public register still does not name the owner. That was the product. The leak is the first time the product can be inspected from the other side of the desk.

Stake is in the files. The paper owner is not the known founders

We already named Medium Rare N.V. and licence OGL/2024/1451/0918 in our Stake review and in the piece on Ireland and Nigeria. The public register confirmed the company and the number. It did not confirm who owns the company.

Follow the Money says the application lists Mladen Vuckovic, Stake’s chief executive, as the sole owner of Medium Rare N.V. In a 2024 disclosure he declared assets of more than $1 billion. Ed Craven and Bijan Tehrani, the two men the press has called the founders for years, are not named in the application. CGA officials themselves questioned whether Vuckovic was really the sole owner. They flagged loans and payments, some running to tens or hundreds of millions of dollars, from Medium Rare to companies and people tied to Craven and Tehrani. Pheijffer told FTM it was incomprehensible that a licence was granted on that record. The CGA granted it anyway, on 9 June 2025. It still shows as Active.

The Casino Secrets index for Medium Rare N.V. lists 54 documents against that one company: the application forms, the company-structure chart, the share ledger, the source-of-funding pack, the 2024 and 2025 financial statements, the operations manual, the AML and KYC policies, and the licence PDF itself. Two domains, 16 related entities. We are not opening those files here. The published reporting is enough to say the thing our review could not say from the register alone: the CGA licensed Stake while it still had unanswered questions about who controlled the company.

The same investigation says 1xBet’s Curacao vehicle, Caecus N.V., was licensed in 2024 with a similar gap. The paper owner is listed as Ihor Hniedash. The three Russians long identified as 1xBet’s founders are not on the form. The CGA asked for more on the relationship and granted the licence without the answers.

The brands we review sit in the same dump

Galaktika N.V., the company behind Flagman and Fresh on licence OGL/2024/169/0146, is in the index as a gaming operator registered on 16 November 2023. The listing shows 52 domains and 11 related entities. That matches what we already wrote in those two reviews: one licence, many brands, the payout record belonging to the operator rather than to the name on the lobby. Domain-proof files in the public index name casinoflagman.com, flagman.casino and flagmancasino.com. We are not treating a filename as a finding. We are treating it as confirmation that the brand-to-company link we already published is the same link the CGA holds on file.

If you play at a Curacao casino we have reviewed, the honest position is this. The licence number we checked in the register is still the licence number. The dump does not invent a new one. What it can do, once you look the company up, is show the ownership chart and the assessor’s notes that the register never published. That is useful. It is also a dump of passports and bank statements, so treat the raw files as a newsroom source, not as a browsing exercise.

What this changes for a player, and what it does not

It does not void a licence. Medium Rare, Galaktika and the rest still show in the CGA portal the way they did last week. A leaked assessment is not a revocation.

It does finish an argument we have been making since we started checking these numbers. A footer seal that reads “licensed and regulated” is a statement about Curacao law. It is not a statement that the regulator knows who runs the company, that the company may take your bet, or that anyone will get you paid if the site goes dark. We walked through that gap in what actually makes a crypto casino trustworthy and in the 2024 crypto rules. The leak is those pages with the working files attached.

Three practical points follow.

• Look up the company, not the brand. Stake is Medium Rare N.V. Flagman and Fresh are Galaktika N.V. If a review or a footer only gives you the trading name, you cannot even search the dump.
• A licence granted on unanswered ownership questions is a weaker licence than the same number looked last month. It does not mean the cashier will bounce. It means the “regulated” line in the marketing is doing more work than the file behind it.
• Do not keep a working balance you would mind losing access to overnight. That advice did not start this week. Ireland, Nigeria and the Brazilian payment ordinance already made it. A regulator that cannot keep its own portal closed is not a reason to get more comfortable.

What we are watching

Whether the CGA names the breach properly, now that the files are public and the 17 September statement still talks as if the scope were unknown. Whether any licence is actually reopened, suspended or left untouched. Whether Medium Rare files an update that puts Craven and Tehrani on the ownership form, or leaves Vuckovic as the sole name. And whether the searchable index stays up. A leak this size gets taken down as often as it gets mirrored.

We will update this post if a licence we have reviewed changes status, or if the CGA publishes a list of affected licensees. Until then the reviews stand on what we measured at the cashier. The leak does not replace a withdrawal test. It does replace the idea that the register was the whole story.

Frequently asked questions