A significant data breach involving the Curaçao Gaming Authority (CGA) has revealed the identities of the owners behind 646 licensed operators. In December 2025, cybersecurity expert Lilith Wittmann from Berlin accessed the online portal of CGA licensees, downloading tens of thousands of confidential documents containing information about around 800 owners.
The leaked materials also included documents from the Maltese regulator and extracts from the commercial registers of Cyprus, Malta, and Gibraltar. This data has become the foundation for an investigation by international publications such as Follow the Money, NRK, NDR, SVT, and Jetzt.at. Here are some key findings:
- The owner of Medium Rare NV, the legal entity for the crypto casino Stake, is listed as Serbian Mladen Vukovic, who claims a net worth of over $1 billion. However, CGA has raised doubts about him being the sole owner, noting payments to entities linked to public founders Ed Craven and Bijan Tehrani.
- CEO and owner of Caecus NV, the legal entity for operator 1xBet, is identified as Ukrainian Igor Gnedash, with an annual income of about €10 million. CGA suspects multiple owners are involved and has requested clarification regarding his connections to public founders Roman Semyokhin, Dmitry Kazorin, and the late Sergey Karshkov.
- The ultimate beneficiary of Novatech Solutions NV, which operates Qbet and 55Bet, is listed as 42-year-old Filipina Joanna Tinako Arenas, although the source of her $1.5 million wealth remains undisclosed.
- Owners of Prolific Trade NV, the legal entity for operator Blaze, include Dutch national Nick van Gorsel, with a claimed net worth of €800 million, and American Nicholas Bogg, with €500 million.
- Thomas Kalman is identified as a key figure in the structure of Germany's largest illegal operator, Platincasino, with the brand's tax debt estimated at €250 million after relocating its legal entity to Curaçao.
- The owner of the Curaçao entity operating the illegal Norwegian operator CasinoFriday is named as a Norwegian with the surname Reid.
This investigation relates to the same breach that CGA reported on September 17, where they announced the localization of the threat and ongoing verification. In March 2026, Wittmann also gained access to the systems of the Maltese regulator MGA.