Curaçao Gambling Leak Exposes Owners Behind Turkey-Facing Betting Sites

A major data breach involving the Curaçao Gaming Authority (CGA) has exposed previously non-public ownership and management information linked to hundreds of online gambling companies. The documents provide an unusually detailed look at the individuals behind Curaçao-licensed operators, including a significant group of companies connected to betting sites targeting players in Turkey.

The material was examined as part of the Casino Secrets investigation, which followed unauthorised access to the CGA’s online licensing system. Follow the Money reviewed records covering 646 licensed entities and verified 897 ultimate beneficial ownership records connected to 767 individuals. The files also contained company structures, financial information, personal disclosure forms and internal regulatory assessments.

Turkey-Linked Companies Also Appear in the Documents

One of the most notable aspects of the leaked files from a Turkish perspective is the presence of Turkish owners and executives within Curaçao-licensed companies. The records show that Turkish individuals are listed as company owners, ultimate beneficial owners or senior managers at several Curaçao-based companies behind betting brands targeting the Turkish market.

Some names also appear across more than one company. This makes it possible to trace ownership and management links between separate entities operating under the Curaçao licensing system through the same set of leaked records.

Access to the CGA Portal Continued for Months

Security researcher Lilith Wittmann said she first gained access to the CGA licensing environment in December 2025. The unauthorised access remained possible until September 2026, when the regulator was informed and the vulnerability was closed.

The CGA later confirmed that unauthorised access had taken place between December 2025 and September 2026. The authority said it strengthened portal security and continued investigating the full scope of the incident.

The timing is significant because Curaçao had only recently overhauled its gambling framework. The National Ordinance on Games of Chance, known as the LOK, came into force in December 2024 and replaced the previous master-licence and sublicence structure with direct licensing and oversight by the CGA.

Under the new framework, operators are required to provide more detailed information about beneficial owners, directors, company financing and key personnel. Those requirements created the extensive corporate and personal records that later became accessible through the compromised portal.

Leak Opens Curaçao’s Ownership Networks to Scrutiny

The Casino Secrets files have turned a cybersecurity breach into a broader examination of the offshore gambling industry. The documents allow ownership records, management structures and connections between different licensed companies to be compared on a scale that was previously difficult using public corporate records alone.

For the Turkish market, the files reveal a substantial network of Curaçao-registered companies with Turkish owners or senior personnel, many of them connected to brands targeting Turkish-speaking players.