From a server breach in the Caribbean, a Berlin-based hacker has drawn back the curtain on one of the world's most permissive gambling jurisdictions, releasing tens of thousands of confidential files from Curaçao's Gaming Authority. The documents expose how major offshore casino operators — some serving millions of consumers across regulated markets — have long exploited a licensing regime too opaque and under-resourced to scrutinise what it was sanctioning. It is a story as old as regulatory arbitrage itself: where oversight is thin, those with something to hide tend to gather.
Casino Secrets leak exposes offshore gambling empire with UK targeting
A regulator asleep at the wheel, hosting 8,000 casinos it barely knows.
Mark
So this leak—it's just files, right? What makes it actually matter for people?
Mimi
It matters because these casinos have been operating in the shadows, targeting people in countries where they're not allowed to. The leak shows how they did it and who owns them. That's the evidence regulators need.
Luke
But we should be clear: the leak itself is stolen data. We're reading confidential files obtained without permission. That's a legal and ethical problem, even if what the files reveal is important.
Mark
Fair point. But what about the companies named—Stake, BC.Game, Santeda? Are they actually breaking the law, or is this just aggressive business?
Mimi
Some of them are. The Santeda investigation found they targeted UK gamblers trying to quit, and they had no UK licence. That's illegal under UK law. BC.Game is accused of the same thing.
Luke
Accused is the right word. We have allegations and leaked documents, but we don't have admissions or court findings yet. The companies have denied or declined to comment.
Mark
What about the ownership stuff—the Georgian businessmen, the connections between Santeda and Upgaming? Is that proven?
Mimi
The documents show the connections. Same names, same email addresses, loans between related companies. But Upgaming's lawyers say they had a business relationship that ended, and that the name overlap is coincidence.
Luke
Which is possible. A common Georgian name appearing twice could be coincidence. The loans could reflect a legitimate past relationship. We have documents, but we don't have a confession or a court order saying "you own this."
Mark
So what's the real story here?
Mimi
The real story is that Curaçao's regulator is asleep at the wheel. They host 8,000 casinos and they didn't catch any of this. They issued licences to people with obvious red flags.
Luke
That part is clearer. The regulator itself has admitted the breach. And the pattern—Stake's founders not on the application but money flowing to them anyway, and the regulator still issued the licence—that's documented failure.
Mark
What happens next?
Mimi
UK regulators will investigate. Other countries probably will too. Some of these companies might face enforcement action.
Luke
Might. We don't know yet. The UK Gambling Commission hasn't said what it will do. Curaçao says it's still investigating. This is the beginning of something, not the end.
O Pulso
- A hacker has released tens of thousands of internal files from Curaçao's gambling regulator, one of the most significant data breaches ever to strike the offshore casino industry.
- The documents reveal that major platforms including Stake.com and BC.Game operated under ownership structures that obscured their true founders — and that the regulator issued licences anyway, despite clear red flags.
- The Santeda network, previously linked to illegally targeting vulnerable UK gamblers trying to quit, is now tied through leaked files to Georgian businessmen and a company called Upgaming, reopening questions about earlier denials.
- BC.Game, which sponsors a Premier League football club, faces fresh scrutiny over allegations it continued accepting UK wagers after surrendering its licence — a criminal offence under British law.
- The UK Gambling Commission has acknowledged the seriousness of unlicensed gambling but declined to comment directly on the leak, while Curaçao's regulator called it an 'ongoing, complex forensic matter.'
- The breach lays bare a systemic failure: a small Caribbean island hosting over 8,000 licensed casinos has functioned as a global gateway for operators who then prey on consumers in jurisdictions where they have no legal right to operate.
From a server breach in the Caribbean, a Berlin-based hacker has drawn back the curtain on one of the world's most permissive gambling jurisdictions, releasing tens of thousands of confidential files from Curaçao's Gaming Authority. The documents expose how major offshore casino operators — some serving millions of consumers across regulated markets — have long exploited a licensing regime too opaque and under-resourced to scrutinise what it was sanctioning. It is a story as old as regulatory arbitrage itself: where oversight is thin, those with something to hide tend to gather.
A Berlin-based hacker has released tens of thousands of confidential files from Curaçao's Gaming Authority, exposing the ownership structures, funding sources, and operational details of thousands of online casinos. The breach has confirmed what regulators and journalists have long suspected: that Curaçao's notoriously opaque licensing regime has repeatedly failed to investigate suspicious applications, effectively enabling major offshore gambling firms to target consumers in markets where they hold no legal right to operate.
Among the most significant revelations concerns Stake.com, a crypto-focused casino that withdrew from the UK in 2025 amid mounting controversy. Leaked documents show its Curaçao-registered entity listed a Serbian national as owner with declared assets exceeding $1 billion — yet regulators found evidence that millions flowed to companies tied to the platform's actual founders, who did not appear on the licence application. The licence was issued regardless.
The leak also deepens scrutiny of the Santeda network, previously exposed for illegally targeting vulnerable UK gamblers attempting to quit. New documents name a Georgian businessman as Santeda's owner and reveal financial ties — including six loans totalling nearly €15.6 million — to a Luxembourg firm connected to Upgaming, a company run by Georgian businessmen. Upgaming's lawyers offered limited explanations, and the discovery has cast doubt on the company's earlier denials of any involvement with Santeda.
BC.Game, sponsor of Leicester City FC, also features in the files, with fresh evidence emerging about its regulatory status after it allegedly continued accepting UK wagers following the surrender of its licence. A smaller operator, Oddsbet, was revealed to have been owned until 2025 by a man from Yorkshire, who said the business served only customers outside the UK.
The Curaçao Gaming Authority confirmed the breach but said it could not discuss an ongoing forensic investigation. The UK Gambling Commission declined to comment on the leak directly. What the files collectively illuminate is a structural failure at the heart of offshore gambling regulation: a jurisdiction with limited resources and apparent reluctance to ask hard questions has issued thousands of licences to operators who then exploit that permissiveness at the expense of consumers elsewhere.
A Berlin-based hacker has released tens of thousands of confidential files from Curaçao's gambling regulator, exposing the inner workings of thousands of online casinos and raising urgent questions about how some of the world's largest offshore gambling operators have evaded scrutiny and targeted consumers illegally.
The leak, obtained by accessing a database maintained by the Curaçao Gaming Authority, lays bare ownership structures, funding sources, and operational details of major gambling firms. The CGA has confirmed it suffered unauthorised access to its portal. The files are particularly significant because Curaçao has become a haven for offshore gambling—the Caribbean island hosts more than 8,000 licensed casinos, roughly one for every 20 residents. The licensing regime there is notoriously opaque, and the leak suggests the regulator has repeatedly failed to act on red flags about applicants and their true ownership.
Among the exposed operators is Stake.com, a crypto-focused casino that withdrew from the UK in 2025 after mounting controversies. Documents show the company's Curaçao-registered entity, Medium Rare NV, listed Serbian national Mladen Vučković as owner, with declared assets exceeding $1 billion. Yet regulators found evidence that millions of dollars flowed to companies tied to the casino's actual founders, Ed Craven and Bijan Tehrani, who did not appear on the licence application. The regulator issued the licence anyway—one of several instances that suggest systematic failure to investigate suspicious ownership claims.
The leak also implicates the Santeda network, a global casino operation previously exposed by the Guardian and Investigate Europe in April. That investigation found Santeda casinos had targeted vulnerable UK gamblers attempting to quit, despite holding no licence from the UK Gambling Commission—a violation of law. Documents in the leak name a Georgian businessman, Onise Chimakhidze, as Santeda's owner and list contact details for Upgaming, a company owned and operated by Georgian businessmen. Santeda also extended six loans totalling €15.59 million to Buda Capital, a Luxembourg firm with Georgian ownership ties to Upgaming. When asked about these connections, lawyers for Upgaming said their client could not explain why third parties had listed their contact details, suggesting a previous business relationship that had since ended. They also noted that a finance chief named in Santeda documents—Torniki Kapanadze—shares a name with an Upgaming employee, though with different spelling, and that the name is common in Georgia. The leak has reopened questions about Upgaming's previous denials of operating Santeda.
BC.Game, which sponsors Leicester City FC, also appears in the leaked files. The company has previously been accused of accepting wagers from UK customers after surrendering its gambling licence, an offence under the Gambling Act 2005. The leak provides fresh evidence of the company's operations and regulatory status.
Other businesses exposed include Oddsbet, a betting platform focused on high-value customers. Until 2025, it was owned by Robert Bostock from Goole in Yorkshire, according to the leaked documents. Bostock claimed his funds came from long-term cryptocurrency investments and a £100,000 loan from another UK-based individual. He sold the business for $240,000 in 2025. Lawyers for Bostock said the loan was never actually drawn and that the business served only customers outside the UK.
The leak has sent shockwaves through Curaçao's gambling sector, which has long operated with minimal transparency and limited enforcement. The UK Gambling Commission said it takes illegal gambling activity seriously and works with partners to disrupt unlicensed operators, but declined to comment on the leak itself. The Curaçao Gaming Authority said it could not discuss details of an "ongoing, complex forensic matter" but pledged to issue further updates and said it remained "committed to transparency."
The breach exposes a fundamental weakness in how offshore gambling is regulated: a regulator with limited resources, questionable oversight practices, and apparent reluctance to investigate red flags has issued thousands of licences to operators who then target consumers in jurisdictions where they have no legal right to operate. The leaked files suggest that for years, major gambling firms have exploited this gap with impunity.
Citações Notáveis
Illegal activity linked to gambling is a threat that we take seriously, and we work closely with partners to identify and disrupt those seeking to operate outside the regulatory framework.— UK Gambling Commission statement
Upgaming believed it was subject to a targeted campaign by various parties, including with vested commercial interests of their own.— Lawyers for Upgaming
Quer a matéria completa?
Leia o original em The Guardian ↗
Technology