The Curaçao Gaming Authority (CGA) has initiated legal action in three countries after a significant data breach exposed thousands of documents related to Curaçao-licensed operators. The breach, carried out by German hacker Lilith Wittman between December 2025 and September 2026, has prompted the regulator to review its digital security protocols and temporarily take its online portal offline.
Details of the Data Breach
Wittman reportedly accessed the CGA’s online portal, subsequently publishing sensitive documents detailing the ownership structures of licensed entities. The breach has drawn attention across Europe, with Wittman alleging that the CGA overlooked leadership issues at certain operators during licence approvals linked to the 2024 implementation of the LOK regulatory framework.
CGA’s Immediate Response and Ongoing Investigation
The CGA has filed complaints in Germany, the Netherlands, and Curaçao, characterising Wittman’s actions as criminal. Specialist firms have been hired to remove leaked information from the internet, and the authority is considering civil legal action. An internal investigation is underway to determine the breach's full impact and to identify improvements for future digital security.
In response, the CGA has taken its online portal offline and is developing a new platform, with a temporary solution planned until full security testing is completed. The regulator emphasised that the new system will only go live after comprehensive testing to safeguard stakeholders.
Implications for Industry Stakeholders
This incident highlights the ongoing digital security risks facing gambling regulators and the wider industry. For operators and affiliates, the exposure of sensitive ownership data could have compliance and reputational implications. The breach also underscores the importance of robust due diligence and the need for regulators to continually update their security measures to protect confidential information.
The CGA has stated that it has maintained strong internal due diligence procedures since it assumed regulatory oversight in 2024, aiming to reassure stakeholders amid heightened scrutiny.
Key takeaways
- Curaçao Gaming Authority suffered a major data breach affecting operator documents.
- Legal complaints have been filed in three jurisdictions, and an internal investigation is ongoing.
- The regulator is developing a new, more secure online portal after taking the old one offline.
- Operators and affiliates may face compliance challenges as a result of the data exposure.