Grey hacker hits Curaçao, claims to be able to expose ownership of offshore licenses

• Lilith Wittmann has gone after the Curaçao Gaming Authorityafter previously breaching the Malta Gaming Authority
• The hacker "laid in wait" for months, collecting information from the regulator
• She has shared information with multiple media outlets, "exposing" the names and ownership of offshore gambling operators

A Berlin, Germany-based grey-hat hacker by the name of Lilith Wittmann has gone after the Curaçao gaming regulator, accessing sensitive business information from the Curaçao Gaming Authority.

Wittmann argues she was able to breach the systems in December 2025, and has been collecting information ever since, and now holds information about owners, finances, and processes.

Wittmann has already released information about entities that are associated with prominent brands in the iGaming industry, mentioning brands such as Platin Casino in a LinkedIn post, claiming that German prosecutors have raided the company’s offices.

In a LinkedIn post, Wittmann detailed how she spent months watching the internal processes at the regulator and what was happening there:

"For nine months, I watched the Curaçao gambling authority at work in real time—without the staff knowing. I could see who owned illegal online casinos, who was financing them, and what the authority knew about their operations. Today, in collaboration with NDR, NRK, SVT, and FTM, I am publishing the #casinosecrets."

What could the consequences be?

Curaçao has been a jurisdiction that has traditionally housed operators that continue to operate without a license secured from a domestic jurisdiction. In other words, a company that is licensed in Curaçao, but offers its products in the United Kingdom without a license from the Gambling Commission, is still considered a "black market" operator, even if it is technically licensed.

In places such as the Netherlands, the regulator has come to several conclusions in recent months. First is that no matter how high the fine it issues, enforcement could prove difficult, as there is very little leverage the regulator can exert.

With gambling operators’ ownership often unknown, especially when it concerns such offshore venues, regulators have limited options when it comes to collecting these fines.

Potentially revealing the names of the real companies and people behind these offshore licensees, however, could give teeth to watchdogs and go after the individuals that have been running the aforementioned black market websites.

The Dutch Gambling Authority has specifically argued that it may be too small on its own to address the rising threat from the black market, calling for a pan-European response. Delving into the ownership of the people behind some of the most popular offshore websites could be a good first step towards addressing this.

The recent breach could be an opportunity for regulators to move aggressively against companies and individuals who may be tied to offering the sort of black market operations that regulated jurisdictions have been trying to turf out.

It took Wittmann less than eight hours to gain the information she needed

Detailing the breach, Wittmann argued that it took her less than eight hours to exploit an easily identifiable security vulnerability and then gain full access to the regulator’s servers.

"This also gave me access to the web portal used for licence management. From then on, I could read every application and every document submitted to the authority," she said.

This is not the first time Wittmann has breached a gambling regulator, previously going after the Malta Gaming Authority (MGA), which has not hesitated to take the grey hat hacker to court. So far, however, Wittmann, may be winning this, as a judge has deemed the hacker’s comments about organized crime and the MGA to be a permissible expression of opinion and not "untrue factual allegations."

Wittmann noted that the MGA’s CTO was flown in to appear in court with Bird & Bird, a prominent law firm in Malta dealing with similar cases, representing the regulator.

Wittmann noted that she could still use information that she has obtained from the MGA and an interim injunction would not stop her from that as confirmed by the court, but to not attempt to hack the regulator again.