Curaçao Gaming Authority Breach Exposes Ownership Records for Hundreds of Offshore Gambling Firms

A nine-month breach at the Curaçao Gaming Authority (CGA) exposed licensing files tied to hundreds of online gambling owners, including records for Stake, 1xBet, and Blaze.com. For PSPs and acquirers serving high-risk verticals, the useful detail is not the breach itself but the ownership data it surfaced: who is behind a Curaçao licence, what the regulator knew, and where the paperwork still looked unfinished.

1. Follow the Money, operating as Casino Secrets, said it reviewed tens of thousands of documents from the CGA’s licensing system, including ownership declarations, licence applications, regulatory assessments, passports, tax information, and financial records. The publication said the review identified about 800 owners linked to nearly 650 licensed gambling firms, and also confirmed 897 records of ultimate beneficial owners for 767 persons in 646 entities.
2. The breach is attributed in the report to Berlin-based cybersecurity researcher Lilith Wittmann. FTM said she registered through the regulator’s licensing portal under the name of a trust-office manager, gained entry to the CGA system for about nine months, and later used a personal Gmail account on behalf of a fictitious DreamCatcher Private Foundation. Access was reportedly granted within days, after which software was uploaded to the portal to widen access to its contents.
3. One of the clearest disclosures concerns Stake. Medium Rare NV is the Curaçao entity, and Serbian national Mladen Vuckovic is listed as its owner. According to records filed with the CGA, Vuckovic had more than $1 billion in assets in 2024. CGA officials, however, questioned whether Vuckovic alone controlled the company, and audits reportedly found large loans and payments involving businesses and individuals linked to Stake founders Ed Craven and Bijan Tehrani. Neither founder was named as an owner on the licence application.
4. The files also raise questions about 1xBet. The brand is associated with a Curaçao company whose owner and CEO is named as Ihor Hniedash. Roman Semiokhin, Dmitry Kazorin and the late Sergey Karshkov have all been publicly associated with 1xBet. FTM said CGA assessors suspected the company had multiple owners and sought more information about the relationship between Hniedash and the people publicly linked to the business. The company still received a Curaçao licence in 2024.
5. Another disclosed operator is Prolific Trade NV, a Curaçao-based company that owns Blaze.com. Its owners are said to include Dutch national Nick van Gorsel and American Nicholas Beugg. The investigation has put renewed attention on Curaçao’s regulatory setup, which changed materially in 2024 when a new framework replaced a decades-old system built largely around private master-licence holders. CGA also acknowledged that some licences were issued while ownership questions remained unresolved.

For payment teams, the practical takeaway is straightforward: Curaçao ownership files can contain more than the public-facing brand story, and in some cases more than the licence application cleanly resolved. That matters when you are deciding whether to onboard, keep, or de-risk a merchant that depends on offshore gaming licences and layered ownership structures.