The Curaçao Gaming Authority (CGA) has filed complaints in three countries following a well-publicised data breach by the German hacker Lilith Wittman.
Complaints have been filed in Germany, the Netherlands and Curaçao after Wittman accessed the CGA’s online portal between December 2025 and September 2026, publishing thousands of documents related to the ownership structure of Curaçao-licensed firms.
She alleged that the CGA had ignored serious problems related to the leadership of various operators when granting licences as part of the implementation of LOK in 2024 in a series of articles published in various languages across Europe.
The CGA described her actions as ‘criminal conduct’, adding that it has hired specialist companies to remove the information available on the internet and is considering civil legal action.
It has also launched an investigation to assess the attack’s impact and consequences, and to identify ways to improve its systems.
The regulator said in a statement: “As more information is handled digitally, organisations around the world face the risk of hacking and data breaches. This does not make what happened at CGA any less serious. It shows why digital security requires continuous attention. CGA must limit the damage and use the investigation’s findings to improve its security and working methods.”
After discovering the breach, the CGA took its online portal offline and has since confirmed it is developing a new platform to replace the compromised one, with a temporary solution expected in the interim.
However, the CGA said it will not be operational until security testing identifies potential weaknesses and ensures it works properly for stakeholders.
In response to Wittman’s allegations, the CGA said it has followed ‘robust internal procedures in performing due diligence’ since it became the overseer of the jurisdiction in 2024.
Don’t forget to subscribe to our Telegram channel!
