Lilith Wittmann Claims Curaçao Gaming Authority Breach

German activist Lilith Wittmann has claimed responsibility for the recent breach of the Curaçao Gaming Authority (CGA), saying she gained access to the regulator’s systems in December 2025 and remained able to monitor them for months.

According to Wittmann, the compromised information includes material concerning casino ownership, financing, licence applications and other regulatory matters.

Working with media organisations in several countries, she has already released some information about licence holders and companies reportedly linked to names including 1xBet, Stake.com, SoftSwiss and Platinum Casino.

Wittmann has also said she intends to publish information identifying the ultimate beneficial owners (UBOs) of online gambling companies operating from offshore jurisdictions.

In an article published on her website, Wittmann described how she allegedly obtained access to the CGA’s computer systems. She claims that after receiving access to the regulator’s online portal, she was able to exploit a security vulnerability within hours.

According to her account, the alleged breach gave her access to the authority’s servers and licence-management system, allowing her to view applications and documents submitted to the regulator.

In a LinkedIn post, Wittmann said:

“For nine months, I watched the Curaçao gambling authority at work in real time without the staff knowing. I could see who owned illegal online casinos, who financed them, and what the authority knew about their operations. Today, in collaboration with NDR, NRK, SVT and FTM, I am publishing the #casinosecrets.”

Wittmann later detailed on her website how she allegedly used a false identity to obtain access to the CGA’s systems.

The incident follows similar allegations involving the Malta Gaming Authority (MGA), with Wittmann having previously acknowledged her involvement in that case.

Details surrounding the Curaçao breach and the full scope of the information involved remain unclear. Wittmann’s stated intention to release UBO information could also raise further regulatory and privacy concerns for players and individuals connected to Curaçao’s online gambling sector.