TLDR
- A searchable archive of more than 40,000 leaked documents from Curaçao’s gambling regulator went public on Wednesday.
- Berlin researcher Lilith Wittmann says she spent nine months inside the Curaçao Gaming Authority’s licensing portal.
- The files identify about 800 owners of nearly 650 licensed gambling companies, including those behind Stake and 1xBet.
- Software supplier Softswiss says it runs no casinos and compares its role to that of Microsoft Office.
- The regulator says the casino “network” described by reporters was “fabricated.”
A searchable archive of leaked documents from Curaçao’s gambling regulator opened to the public on Wednesday. It went live a day after European news outlets published their first stories from the files.
The Casino Secrets archive holds more than 40,000 documents about casinos licensed by the Curaçao Gaming Authority (CGA). The site states that being included “does not imply illegal or improper conduct.”
How the Leak Happened
The files come from Lilith Wittmann, a 30-year-old security researcher and journalist based in Berlin. She says she and collaborators spent nine months inside the regulator’s systems, starting in December 2025.
Wittmann registered under the name of a trust-office manager already known to the regulator, using her own Gmail address. She claimed to represent a fake company called “DreamCatcher Private Foundation” and got portal access within days.
She then uploaded software that let her take control of the licensing system, according to Dutch outlet Follow the Money (FTM). The files include license applications, passports, tax returns and financial records.
FTM published the main investigation on Tuesday with NDR, NRK, SVT and Jetzt. It said the files identify about 800 owners of nearly 650 licensed companies running thousands of gambling websites.
Ownership Questions and Pushback
The first reports focus on crypto gambling site Stake. Its Curaçao company, Medium Rare N.V., is officially owned by Serbian national Mladen Vuckovic, who declared assets of more than $1 billion in 2024.
CGA officials questioned whether Vuckovic was the sole owner, FTM reported. They found loans and payments worth tens or hundreds of millions of dollars going to people and firms linked to Stake founders Ed Craven and Bijan Tehrani.
Similar questions surround 1xBet. Ukrainian national Ihor Hniedash is listed as owner of Caecus N.V., but assessors suspected “multiple owners” and asked about his ties to Russian founders linked to the brand.
The regulator granted Caecus a license in 2024 without getting those answers. The CGA told FTM it did not reject firms right away during the move to a new regulatory system.
Softswiss, a technology group the reporting places at the center of a network of operators, said in a Sept. 9 lawyer’s letter that it “operates no online casinos itself.” It compared its role to providers of Microsoft Office or Apple products.
On Platincasino, a German-facing brand tied to a Frankfurt prosecution, Softswiss said it “may have provided individual software components” but was not involved in operations. Wittmann has pointed to an alleged €250 million German gambling tax shortfall linked to the brand.
The CGA rejected reporters’ claim of a Softswiss network of about 1,000 domains, calling the grouping “fabricated by you.” It said a shared technology platform does not turn separate license holders into one network.
The regulator also said a Curaçao license “does not authorize an operator to conduct activities in Germany.” It told FTM it has rejected about 28% of applications since 2023.
The CGA confirmed the unauthorized access on Sept. 17 and said the breach was contained. A forensic investigation is still underway.
Wittmann said the public interest outweighed how the files were obtained. The Malta Gaming Authority, whose systems she breached earlier this year, has an injunction case against her in a Berlin court, where a ruling was postponed shortly before publication.
