Curaçao gaming leak: what's confirmed and what isn't

The Curaçao Gaming Authority (CGA) now confirms what a German security researcher says she did: an account registered "in December 2025 under a false identity" had access to the customer-facing part of its licensing portal "from December 2025 until September 2026". The regulator calls it "a serious breach under Curacao law" and says it "will pursue reporting of this event to the relevant Authorities". It has not said what was taken: "The full extent of the material obtained has not yet been established."02

Since 22 September, Follow the Money and partner outlets in Germany, Norway, Sweden and Austria have published stories built on the files, and a searchable archive of the documents has opened to the public. This page separates what the CGA has confirmed, what journalists have reported, what is circulating without support, and what the regulator's public register lets anyone check. For a step-by-step licence check, see our guide to checking a crypto casino licence.

What the CGA has confirmed

Two statements, both linked from the CGA's news page.

17 September 2026. The CGA said it had "identified unauthorized access to its online gaming portal", that the access "has been contained" and its source identified, and that the investigation "has not yet established the full scope of the incident".01

22 September 2026. After the first stories appeared, the CGA said the researcher's claims are "consistent with its internal investigation". It added:02

• Access came through the customer-facing side of the licensing portal, using an account opened in December 2025 under a false identity that combined a variant of a real person's name with a company registered in Curaçao.

• Access ran from December 2025 until September 2026, when it was found and ended.

• The CGA has strengthened portal security since 17 September and told operators to apply changes on their side.

• It "will not repeat figures it cannot verify and will state what was taken once the investigation supports it".

• On its licensing, it says it has followed "robust internal procedures" since the 2024 reform and "does not find it prudent to draw conclusions on its licensing process by looking at separate documents".

What was reported

Follow the Money published the first story on 22 September 2026, with NDR, NRK, SVT and Jetzt. It reports that the files identify about 800 owners behind nearly 650 licensed gambling companies, represented by around 30 trust offices, and that the CGA granted some licences while questions about ownership were still open. The CGA's reply, as reported, points to the transition period of the 2024 reform.04

By 24 September a searchable archive of the documents was public. Bitcoin.com News reported that it holds "more than 40,000 documents" and states that inclusion "does not imply illegal or improper conduct". Several companies named in the reporting dispute its findings. So does the regulator: according to Bitcoin.com News, the CGA told reporters that a grouping of about 1,000 domains was "fabricated", and says it has rejected about 28% of applications since 2023.05

We don't link to the archive and don't use it. According to Follow the Money, the files include passports, tax returns and financial information of private individuals, taken without consent, and most of them can't be checked against any public source.04

What is circulating that we could not confirm

Posts on social media since 24 September repeat larger numbers and link the leak to an arrest:

• "84,000 documents" and "more than 1,000 companies". We found no source for 84,000. Follow the Money's own analysis counts 646 licensed companies and tens of thousands of documents; the archive says more than 40,000 documents, as reported by Bitcoin.com News. One outlet, Protos, wrote of over 1,000 casinos and gambling firms. The CGA says it won't put a number on it until its investigation does.

• "An owner has already been arrested on the basis of the files." There was an arrest, but not on that basis as far as any source shows. Frankfurt prosecutors searched 11 properties on 8 September 2026 and arrested the main suspect in an illegal online gambling case covering July 2021 to 2023 and about €5.86 billion in stakes. Germany's gambling regulator, the GGL, welcomed the arrest on 17 September and warned players against Platincasino by name. That happened before the Curaçao stories were published, and neither the prosecutors nor the GGL mention Curaçao or a leak. Reporting in the Casino Secrets series says Platincasino's brand, domains and player data were sold in 2023 to Latiform B.V., one of the companies in the table below; a lawyer for the person concerned called the accusations baseless. Prosecutors have not named the suspect, and neither do we.

What the public register shows

The CGA's public licence register is a PDF. For each licence it prints the licence number, licensee company, B2B or B2C, the company's registration number, issue date, expiry date and, for most entries, a status. It does not print owners, brands or domains. That is why the leak matters: the register tells you which company holds a licence, never who stands behind it.03

We looked up the companies named in the reporting in the edition dated 21 September 2026, still the latest on 25 September:

All eight hold a current entry. Seven of them are among the 163 of the register's 207 "Indefinite" entries that share the printed issue date 24 December 2025; the register doesn't define that status. None of the eight is in the CGA's enforcement register dated 14 September. That register does list Novatech Solutions N.V., the company the reporting links to Qbet, as revoked on 22 May 2026. We traced that entry through nine register editions in our research on Curaçao's two revoked lists.0311

Medium Rare N.V.'s entry is the one to read carefully: "Assessment in progress" with a printed expiry date that passed on 9 June 2026. On 21 September, 276 of the register's 281 "Assessment in progress" entries carried a past date, so this is common in the register, not specific to Stake. Our page on Stake's licence and operator sets out what the terms and the register print.03

Of the 75 operators BullsRank tracks, 20 cite a Curaçao licence. On their profiles, 10 read "Licence record verified", 7 "Licence record verified · review period ended", 1 "Register lists the licence as revoked", 1 "Licence doesn't list this domain" and 1 "Operator-stated". None of these statuses changed because of the leak; the register hasn't published a new edition since 21 September.11

What this means if you play at a Curaçao-licensed casino

• Your licence check works the same way. Look up the licence number in the latest register PDF, read the status and dates together, open the certificate for the exact domain at cert.cga.cw, and check the enforcement register. Our Curaçao licence check guide walks through it.

• Nothing published so far points to player data. The reporting describes licensing files, but the CGA has not finished establishing what was taken. It says it will notify people directly if the investigation finds their information may have been affected.

• Expect fake notices. On 25 September the CGA used www.cga.cw (news and register), portal.cga.cw (licensing portal), cert.cga.cw (certificates) and gamingcontrol.spin-cdn.com (PDF files). A message about the leak that points anywhere else, or asks for documents, passwords or payment, is not from the regulator.

• Complaints follow the same route. The CGA "does not mediate in individual disputes": complain to the operator, then to its dispute-resolution provider. See the Curaçao complaint process.

What we are not saying

We are not saying any company in the table did anything wrong, and we are not naming anyone the reporting names as an owner. We report what the CGA and the published stories say, with dates, and what the public register prints. Companies named in the reporting have disputed it; any response sent to us goes on this page with its date.

Update log

• 25 September 2026: CGA statement of 22 September, reporting of 22–24 September, social-media claims checked (including the Frankfurt arrest of 8 September), register lookups of named companies. Operator counts updated to 75 tracked, 20 citing Curaçao.

• 21 September 2026: first published after the CGA statement of 17 September.