Online Casinos Licensed in Curacao Hacked and Data Leaked

A Berlin-based hacker has gained access to a database belonging to the Curaçao Gaming Authority, leaking a host of sensitive files into the public domain.

Tens of thousands of files have been leaked according to the regulator, with some revealing the internal workings of firms like Stake.com and BC.Game.

Curaçao, the Caribbean island, has become a hotbed of gambling site licensing, with lower fees and softer rules attracting operators unable – or unwilling – to secure a licence from the UK Gambling Commission or the Malta Gaming Authority.

The data confirms that more than 8,000 online casinos are now registered in Curaçao, which is roughly one per 20 people that live on the island.

CGA Hacker Revealed

The Curaçao Gaming Authority (CGA) has confirmed the claims made by Lilith Wittmann, the German hacker who has taken the credit for the data breach.

In amongst the reams of files are the ownership details of thousands of gambling sites, including a number that are operated by British born or based individuals – including those that have targeted UK players despite not having a Gambling Commission licence.

BC.Game, the offshore casino that has been accused of trying to woo British customers even after surrendering their licence, feature heavily in the leak, as do details of the owners behind Stake – with the new documents suggesting some confusion over who actually owns the company.

According to the CGA, Mladen Vuckovic is Stake’s owner. However, the leaks suggest that Ed Craven and Bijan Tehrani – who didn’t feature on the company’s licence application – are in fact the owners, which would imply question marks about the regulator’s due diligence.

Santeda Under the Spotlight

Another operating company that features in the leaks is the controversial Santeda International.

They’re the holding company of brands like Rolletto, CosmoBet and ZizoBet that came into the crosshairs of a joint investigation by The Guardian newspaper and Investigate Europe earlier this year.

According to their research, a handful of the Santeda brands were found to have targeted UK customers that were actively trying to quit gambling via programmes like GamStop.

That is, it goes without saying, illegal… especially for a company that holds no UK licensing.

Unauthorised Access

Although they didn’t comment specifically on the leaks, a spokesperson for the Gambling Commission did refer to the episode indirectly when quizzed by The Guardian.

“Illegal activity linked to gambling is a threat that we take seriously, and we work closely with partners to identify and disrupt those seeking to operate outside the regulatory framework,” they said.

And representatives from the CGA also refused to comment, beyond confirming that the regulator was the subject of ‘unauthorised access’ to their database. They refused to answer further questioning about what they described as an ‘ongoing, complex forensic matter.’

Can Curaçao Licensed Sites Be Trusted?

This isn’t the first time that Curaçao’s connection with online casino gaming has come under the microscope.

Back in 2021, a probe conducted by Investigate Europe found that nearly 1,000 blacklisted sites – which had been vetoed for a range of reasons, including unfair T&Cs, inadequate security or selling player information to third parties – were registered on the tiny Caribbean island.

Many critics believe that it is too easy for would-be gambling site owners to secure a licence from the CGA, who have been accused of being ‘too soft’ in their judgement of licensees.

That’s not to suggest that all Curaçao licensed sites are incompetent or scams, but for players based in the UK there’s simply no reason to take the risk of registering with them when there’s a much more stringent regulatory system in place here via the Gambling Commission.