Curaçao Gaming Authority licensing system hacked, 84,000 confidential documents reportedly exposed, and at least one offshore iGaming owner has already been arrested

The Curaçao Gaming Authority (CGA) licensing system has reportedly been hacked, with more than 84,000 confidential documents and information on 1,000 companies tied to offshore iGaming said to have been published publicly. For PSPs, acquirers, and banks serving high-risk merchants, the practical problem is simple: a licensing leak of this size turns due diligence, ownership screening, and adverse-media checks into a much messier exercise.

1. According to the material circulating online, the exposure includes 84,000 confidential Curaçao documents, including names, documents, and company records, plus information on 1,000 companies linked to offshore iGaming. The files were published on casinosecrets.lol.
2. The timeline, as described in open sources, starts with German journalist and hacker Lilith Wittmann allegedly breaching the Curaçao gambling regulator’s servers in December 2025 and downloading as much data as possible. The claim is that the volume was large enough to require help from investigative journalists at several European media outlets just to process it.
3. By the end of August, the group behind the project had reportedly registered the domain, and in recent days launched the site. The value of the setup is not just that the files are online; the journalists are also using them to publish case-by-case investigations into individual iGaming products and companies, with 7 articles reportedly written in a single day.
4. The articles are said to combine the leaked documents with open-source information, including social media activity and luxury lifestyle signals. In other words, this is not just a document dump. It is document-to-entity mapping, and that is the part compliance teams usually have to deal with when the questions from banks, acquirers, or regulators start arriving.
5. Less than 48 hours ago, on 22.09.26, the site reportedly published a piece about the owner of the offshore iGaming product Platinum Casino, and the original text says at least one owner of a large offshore iGaming product has already been arrested on the basis of the leak.

For high-risk payment providers, Curaçao matters because it is one of the licensing jurisdictions that shows up again and again in offshore iGaming merchant portfolios. When the licensing infrastructure itself becomes part of an investigation, the downstream effects are usually felt first in onboarding, then in enhanced due diligence, and then in the uncomfortable question of which merchants stay bankable at all.