Curaçao Casino Licence Leak: What It Means for Canadians
· Editorial team
The September 2026 Curaçao Gaming Authority leak: what was taken, what the regulator confirmed, which brands were named, and what Canadian players should do.
The Curaçao casino licence leak, published on 22 September 2026 under the banner #CasinoSecrets, is the largest exposure of an offshore gambling regulator's internal files on record. A Berlin-based security researcher held access to the Curaçao Gaming Authority's licensing portal for roughly nine months, and an international consortium of newsrooms (Follow the Money, NRK, NDR, SVT and Austria's JETZT) spent that time reading what the regulator saw when it granted licences: ownership declarations, passports, tax returns, assessor notes and support tickets. For Canadian players the story matters more than most, because outside Ontario and Alberta the majority of the casinos Canadians actually use hold exactly this licence. This guide sets out what was leaked, what the regulator has confirmed, what remains unverified, and what a Canadian player should do about it.
What was leaked, in the regulator's own words
The Curaçao Gaming Authority (CGA) issued two statements. On 17 September 2026 it said it was investigating "unauthorised access" to its online gaming portal, that its service provider had started a forensic investigation, that the access had been contained and its source identified, and that there was no indication the regulator's core technical infrastructure was compromised. On 22 September, the day the stories went live, it went further: an account had been created in December 2025 under a false identity, combining a variation of a real person's name with an existing company registered at the Curaçao Chamber of Commerce; that account stayed active until September 2026; the incident is "a serious breach under Curaçao law" and will be reported to the relevant authorities.
The CGA also said something worth keeping in mind when reading the coverage: it "will not repeat figures it cannot verify and will state what was taken once the investigation supports it." The consortium's site, casinosecrets.lol, describes its archive as more than 84,000 documents, more than 2 TB of data and more than 1,000 iGaming companies. Follow the Money, the outlet that led the investigation, uses the more careful "tens of thousands of confidential documents." Those are the consortium's numbers, not the regulator's.
On 23 September the CGA defended its licensing process, saying it "does not find it prudent to draw conclusions on its licensing process by looking at separate documents and not considering the whole context of the particular applications," and listed the security changes made since 17 September: a hardened portal, new controls in back-office and customer-facing systems, and software upgrades. Operators were told to update their side of the integration.
Timeline of the breach and the publication
| Date | Event | Who confirmed it |
|---|---|---|
| 3 December 2025 | An account under an assumed name is registered on the CGA licensing portal; according to the researcher, full server access followed within hours | Lilith Wittmann's own write-up; CGA confirms a December registration under a false identity |
| 17 March 2026 | Malta Gaming Authority discloses a breach of its systems; four days later Wittmann claims responsibility and says the data went to media partners and authorities | MGA statement, Maltese and industry press |
| 8 September 2026 | Frankfurt prosecutors search 11 properties, execute one arrest warrant and freeze about EUR 82 million in an illegal online gambling case (details below) | Staatsanwaltschaft Frankfurt via hessenschau, 9 September |
| 17 September 2026 | CGA confirms it is investigating unauthorised access to its portal | CGA statement |
| 22 September 2026 | #CasinoSecrets published by Follow the Money, NRK, NDR/STRG_F, SVT and JETZT; casinosecrets.lol goes live; CGA follow-up statement confirms the nine-month access and false identity | The outlets themselves; CGA |
| 23 September 2026 | Consortium opens document search to the public at 08:00 CEST; CGA publicly defends its licensing process | casinosecrets.lol; Curaçao Chronicle |
What the journalists say the files show
Follow the Money's headline finding is about scale and secrecy. The consortium says it identified roughly 800 owners behind nearly 650 licensed gambling companies that together run thousands of gambling websites, and that it manually verified 897 ultimate-beneficial-owner records covering 767 individuals. Most owners are European; the countries that come up most often are Ukraine, the United Kingdom and Cyprus, with Cyprus notable because many British and Ukrainian owners hold their companies there. The Netherlands, Norway and Austria each got a national story from the partner newsrooms. Owners from North America appear in the data, but no Canadian-specific reporting has been published as of this writing.
The second finding is about how licensing decisions were made. FTM reports that assessors flagged serious problems, then accepted incomplete answers; that licences were granted while ownership questions remained unanswered; that source-of-wealth documentation was sometimes missing; that some applicants did not appear to have the funds to own the companies they claimed; and that warnings from foreign regulators were not always acted on. Wittmann's own write-up adds a structural point: much of the due diligence was carried out by private contractors rather than CGA staff, with a Maltese consultancy and a Cypriot consultancy doing suitability assessments.
Two figures from her account describe the size of the system: around 550 active licences at an annual fee of about EUR 47,450, and around 8,200 casino domains registered in the database. Those numbers come from her reading of the portal and have not been confirmed by the CGA.
A forensic accountancy professor quoted by FTM, Marcel Pheijffer, summed up the risk in one sentence: "This is a business that is highly susceptible to money laundering, particularly when it comes to transactions in cryptocurrencies."
Which brands have been named so far
The published stories concentrate on a small number of operators. We list them because they are large, because they were named by the consortium, and because at least one of them takes Canadian players. We are not repeating any personal document from the leak.
| Brand | Licensed entity named in coverage | What the reporting says | Relevance to Canada |
|---|---|---|---|
| Stake | Medium Rare N.V. | Curaçao officials questioned whether the declared owner was the sole owner after seeing loans and payments to companies tied to the platform's founders, who were not on the application | Accepts players in Canada outside Ontario under CGA licence OGL/2024/1451/0918; an Ontario launch under a local licence has been announced but is separate |
| 1xBet | Caecus N.V. | Regulator suspected multiple owners and asked about ties to the brand's publicly reported founders, then licensed the company anyway in 2024 | Widely available to Canadian players outside regulated provinces |
| Blaze, Qbet | Various | Cited by FTM as examples of ownership questions left open | Primarily other markets |
| Platincasino | Red Rhino Ltd (Malta), later a Curaçao entity | Subject of a separate Wittmann story drawing on Malta Gaming Authority files; named by Germany's regulator GGL as an illegal offer | German market; see next section |
| Softswiss | Berlin-based supplier | Separate story on the platform provider behind many Curaçao-licensed brands | Supplier to many casinos that serve Canada |
Being named in a story is not a finding of wrongdoing. Several of the companies have pushed back publicly, and the CGA's position is that individual documents do not represent the full application file.
The Frankfurt raid and why it keeps being linked to the leak
On Tuesday 8 September 2026, more than 100 officers from the Frankfurt public prosecutor's office, the Frankfurt tax office, the North Rhine-Westphalia financial crime office and Frankfurt police searched 11 properties in Frankfurt, the Rhine-Main region and Cologne. The prosecutor's summary, published on 9 September: five suspects accused of offering online gambling without a German licence since at least July 2021; about EUR 5.86 billion in stakes processed between July 2021 and the end of 2023; an estimated EUR 77.6 million in unpaid gambling tax for 2024 alone; one arrest warrant executed against the main suspect; an asset restraint order of about EUR 82 million, luxury vehicles seized, bank accounts frozen. The investigation had been running for more than three years. On 17 September Germany's gambling regulator, the GGL, welcomed the operation and warned consumers by name against "illegal offers such as Platincasino."
The link to the leak comes from Wittmann's story "Wem gehört das Platincasino?", published on 22 September, which uses Malta Gaming Authority records to trace the brand from a Maltese licensee (MGA/CL1/1364/2017) to a Curaçao company that bought its assets in October 2023. Because the raid landed two weeks before the stories, a theory circulating on social media and in Telegram channels holds that the journalists handed their material to prosecutors and the arrest followed. Nothing published supports that. Prosecutors describe a three-year investigation. Wittmann herself does not claim her data triggered the raid; she notes that she put her questions to the alleged owner on 28 August and that the raid happened independently. The suspect's lawyer has called the accusations baseless, and no charges have been announced. We do not name the individual here: German authorities have not, and the presumption of innocence applies.
What the case does show is the direction of travel. A regulator's files, once public, let anyone map a brand to its licensee, its parent company and its payment structure. Prosecutors in any country can do the same. For operators that took German players without a German licence, that exposure is now permanent.
What this means for Canadian players
If you play in Ontario or Alberta
Ontario's market has been regulated by iGaming Ontario and the AGCO since April 2022, and Alberta's opened under the Alberta iGaming Corporation and AGLC on 13 July 2026. Casinos licensed there are not Curaçao licensees for the purposes of your account; they hold a provincial registration, are audited locally and have a Canadian complaints route. The leak does not change your legal position. Where it may matter is indirectly: a group that owns a Curaçao brand and an Ontario brand will face questions from the AGCO if the Curaçao side is shown to have misrepresented ownership.
If you play anywhere else in Canada
British Columbia, Quebec, Manitoba, Saskatchewan and the Atlantic provinces license only their own lottery-corporation sites. Every other casino a player in those provinces uses is an offshore operator, and the Curaçao licence is the most common licence among them. That is the group the leak is about. The practical consequences, in order of likelihood:
- Operator churn. Brands whose owners were exposed may rebrand, migrate to another licence (Anjouan, Kahnawake and Tobique are the usual destinations) or shut down. Watch for a casino changing its footer licence text or its terms with little notice.
- Slower withdrawals at some sites. An operator dealing with press enquiries, bank de-risking or a licence review tends to add manual checks. Our timed Interac tests are the fastest way to see whether a specific site has slowed down; we publish them in the monthly payout check.
- Enforcement in other countries. Germany acted first because it had a case ready. Countries with active grey-market enforcement, Australia and the Netherlands among them, have the same data. Canada is not among the countries with an offshore enforcement program of that kind, so direct action against a site over Canadian players is unlikely in the short term.
- A better basis for choosing a casino. The reporting names the licensed entity behind each brand. That is more than the Curaçao public register has offered for most of the last decade, and it lets you check whether a casino's stated owner matches what a regulator saw.
What does not change
Your funds at a solvent operator are not affected by a regulator's data breach. Nor is your legal position as a player: in Canada, placing a bet with an offshore site is not an offence for the player in any province. The risk has always been on the operator side, and that is where the leak lands.
Is your own data in the leak?
Almost certainly not. The files described by the consortium are the regulator's licensing records: company applications, ownership declarations, passports and tax returns of owners and directors, assessor notes, support tickets, payment records for licence fees and domain registrations. Player accounts, deposits and identity documents live on the operators' own systems, not at the regulator, and no outlet has reported player data in the archive. If a casino you use contacts you about a data incident, that would be a separate event at the operator, not this one.
The people whose data is in the leak are owners, directors and staff of licensed companies. The consortium says it has restricted publication of personal documents and is publishing findings rather than raw files, although the searchable document set opened on 23 September. We link to the reporting, not to the archive.
What to do now: a short checklist
- Find the licence line in your casino's footer and note the licence number and the company name. Our guide to verifying a Curaçao casino licence walks through the check step by step.
- If the company name in the footer differs from the licensed entity named in the reporting for that brand, ask support which company you actually have a contract with. The answer belongs in the terms.
- Do not keep a large balance at an offshore site while the industry is reorganising. Withdraw regularly; in our September test the fastest Interac e-Transfer payout on our list arrived in 41 minutes and the slowest we still consider acceptable took just under 24 hours.
- If a withdrawal stalls and support goes quiet, use our free player help desk. We know which operators have changed licence or company in the last month.
- If you are in Ontario or Alberta, play on a provincially licensed site. The offshore alternative gives you nothing you cannot get locally, and the leak has just shown what the offshore paperwork can look like.
- Set a deposit limit regardless of where you play. The tools and Canadian support lines are on our responsible gambling page.
Sources
- Follow the Money: Curaçao's secretive gambling industry exposed in leak (22 September 2026)
- Curaçao Chronicle: CGA confirms unauthorized access lasted nearly ten months (23 September 2026)
- Curaçao Chronicle: CGA defends licensing process (23 September 2026)
- NEXT.io: Curaçao Gaming Authority confirms hack (18 September 2026)
- hessenschau: Fast sechs Milliarden Euro mit illegalem Online-Glücksspiel umgesetzt (9 September 2026)
- GGL: statement on the Frankfurt operation (17 September 2026)
- The Shift News: Hacking the Malta Gaming Authority (27 March 2026)
- Lilith Wittmann: Casinolizenzen aus Curaçao (22 September 2026)
The short version
The Curaçao casino licence leak is confirmed by the regulator, published by serious newsrooms, and already being used by enforcement agencies in Europe. For a Canadian player the direct effect is small: your money and your legal position do not change. The indirect effect is real: the operators you use are about to be sorted, publicly, into those whose paperwork holds up and those whose does not. Check the licence line, keep balances low, and prefer a provincially licensed site if you live in Ontario or Alberta. We will update this page as the consortium publishes further stories and as the CGA reports what was actually taken.
About the editorial team. Our editorial team tests online casinos for Canadian players and helps them when a payout goes missing. Every casino listed on this site has been signed up for, deposited to and cashed out of with our own money. Corrections and reader experiences: see our about page.
Frequently asked questions
What is the Curaçao casino licence leak?
A Berlin-based security researcher held access to the Curaçao Gaming Authority's online licensing portal from December 2025 to September 2026 and shared the files with an international consortium of newsrooms, which published the #CasinoSecrets investigation on 22 September 2026. The regulator has confirmed the unauthorised access and the false-identity account.
Is my casino account or my personal data in the leak?
No outlet has reported player data in the archive. The files described are the regulator's licensing records: company applications, ownership declarations, owner passports and tax returns, assessor notes and support tickets. Player accounts are held by operators, not by the regulator.
Did the Curaçao leak cause the Frankfurt arrest?
Nothing published supports that. Frankfurt prosecutors say their investigation ran for more than three years, and the researcher herself does not claim her material triggered the 8 September raid. The two events overlap in time, and the leaked files corroborate the corporate structure, but no causal link has been shown.
Are Curaçao-licensed casinos legal in Canada?
Outside Ontario and Alberta they operate in a grey market: not licensed in Canada, but Canadian players are not committing an offence by using them. In Ontario (since April 2022) and Alberta (since 13 July 2026) only provincially licensed operators may take players.
Which casino brands were named in the CasinoSecrets stories?
Follow the Money discussed Stake (Medium Rare N.V.), 1xBet (Caecus N.V.), Blaze and Qbet, and the consortium published separate stories on Platincasino and the supplier Softswiss. Being named is not a finding of wrongdoing, and several companies have disputed the reporting.
What should a Canadian player do after the leak?
Verify the licence line in the casino footer, confirm the company matches across the footer, terms and validation page, keep balances low at offshore sites, withdraw regularly, and if you live in Ontario or Alberta, use a provincially licensed casino.