The Casino Secrets leak has brought internal records from the Curaçao Gaming Authority into public view, exposing ownership details and source-of-wealth declarations for offshore gambling businesses. The regulator, which oversees more than 8,000 online casinos on the island, has confirmed that its portal was accessed without authorisation and describes the episode as a complex forensic matter. The release of these records has renewed scrutiny of how the Caribbean licensing regime vetted applicants before granting operating rights.
What the published files show
According to The Guardian, the data set contains a very large cache of private regulatory records kept by the Curaçao Gaming Authority. It covers ownership and source-of-wealth information for some of the world’s largest online casinos, including Stake.com, the Santeda network and BC.Game. Some businesses appear to be owned or operated by British citizens, while BC.Game has previously been accused of accepting UK customers after giving up its licence, which would breach the Gambling Act 2005.
CGA confirms unauthorised portal access
A Berlin-based hacker named Lilith Wittmann claims to have reached a database operated by the CGA. The authority confirmed that its portal had been subject to “unauthorised access”. It said it could not respond to questions while an “ongoing, complex forensic matter” is being examined, but stated that it was committed to transparency and would provide updates. Curaçao’s licensing regime has long been described as opaque; the island hosts one casino for every 20 residents.
Licence decisions despite red flags
One example concerns Stake.com’s local company, Medium Rare NV. Records list Mladen Vučković as the owner and show he declared assets above $1bn in 2024. Investigative platform Follow the Money reported that regulators asked whether he was the true owner after finding large sums sent to companies tied to Stake’s founders, Ed Craven and Bijan Tehrani. Neither founder was on the application, yet the Curaçao regulator still issued the licence. Follow the Money said this was one of several instances where the authority did not act on warning signs.
BC.Game also appears in the leaked material, with previous accusations that it continued to serve UK customers after surrendering its licence.
Santeda network and Upgaming connections
The Santeda network had been exposed in April by the Guardian and Investigate Europe; its casinos were said to have approached vulnerable UK gamblers who were trying to stop, despite lacking a Gambling Commission licence. Newly published CGA submissions identify Onise Chimakhidze as Santeda’s owner and list Upgaming email addresses as contact points. Files also show six loans totalling €15,590,000 (£13,420,000) to Buda Capital, a Luxembourg company owned by Georgians with stakes or directorships at Upgaming. Upgaming’s lawyers said they could not speculate about why third-party contact details appeared and described a targeted campaign by parties with commercial interests; they did not explain the loans. A 2025 document named Torniki Kapanadze as Santeda’s finance chief, while a LinkedIn profile showed a Tornike Kapanadze at Upgaming; Upgaming’s lawyers said the name is common and the spelling differs.
British-linked company in the leak
Oddsbet, a betting business aimed at VIP gamblers, was owned until 2025 by Robert Bostock from Goole, according to the data. His company’s submission said the source of funds came from long-term cryptocurrency investments and a £100,000 loan from another UK-based person. The records suggest he sold the firm for $240,000 in 2025. Bostock’s lawyers said the loan was never drawn and that the business only served customers outside the UK.
What stronger oversight looks like
In the United States, states with regulated real-money online casino markets require operators to complete identity checks, game testing, payment procedures, data protection and regulatory oversight, according to Yes Weekly. Seven states currently operate such markets: New Jersey, Pennsylvania, Michigan, West Virginia, Connecticut, Delaware and Rhode Island. The UK Gambling Commission said it could not comment on the leak but added: “Illegal activity linked to gambling is a threat that we take seriously, and we work closely with partners to identify and disrupt those seeking to operate outside the regulatory framework.” The contrast highlights what critics say is missing from Curaçao’s approach now that ownership and source-of-wealth details are publicly visible.
