A vast leak from the Curaçao Gaming Authority (CGA) has exposed confidential ownership, financial and compliance records connected to some of the world's largest offshore online casinos, raising new questions about beneficial ownership checks and the security of regulatory data.

The Casino Secrets investigation analyzed more than 84,000 documents and over 2TB of data involving more than 1,000 iGaming companies. The material includes information submitted as part of Curaçao's licensing process, giving investigators unusual access to corporate structures, beneficial ownership records, financial declarations and source-of-wealth information.

The CGA has confirmed that its online gaming portal was accessed without authorization. It later said the access began in December 2025 through an account created using a false identity and continued until September 2026. The regulator says its forensic investigation remains ongoing and has warned against drawing conclusions from individual documents without the complete context of an application.

The latest reporting from The Guardian on September 26 puts several internationally recognized gambling companies under the spotlight, while also raising a wider question for the industry: how confidently can regulators establish who ultimately owns and controls an online casino?

Santeda Appears in Leaked Files

Santeda International appears prominently in the files. Documents submitted to the CGA identify Georgian national Onise Chimakhidze as its owner, while other records contain contact information associated with gambling technology company Upgaming.

Upgaming has denied operating Santeda and told The Guardian that a previous commercial relationship with the company had ended.

The documents also reportedly show six loans from Santeda totaling €15.59 million to Luxembourg-based Buda Capital, whose owners include people connected with Upgaming. Upgaming did not provide The Guardian with an explanation for the loans and said it believed it was the subject of a targeted campaign.

BC.Game also appears in the leaked material. The company has previously faced allegations concerning access by UK customers after surrendering its British license. The UK Gambling Commission told The Guardian that it could not comment on leaked documents, but said illegal gambling activity remains an enforcement priority.

These disclosures come from leaked documents and investigative reporting. They are not findings of criminal conduct by the CGA or another regulator.

Curaçao's Licensing Reforms Face a Real-World Test

The timing is particularly significant because Curaçao has spent years rebuilding its international gambling framework.

The National Ordinance on Games of Chance (LOK), which took effect in December 2024, moved the jurisdiction toward direct licensing and greater regulatory oversight. The CGA is also responsible for supervising gambling companies for compliance with anti-money laundering and counter-terrorist financing requirements.

Beneficial ownership is central to that process. Regulators need to understand not simply which company holds a casino license, but who ultimately owns or controls that company, where the funding originates and whether ownership structures create money laundering, sanctions or suitability risks.

Casino Secrets provides an unusual view of how those checks operated behind closed doors. The CGA has defended its procedures, saying applications undergo due diligence and that unresolved matters can remain subject to follow-up after licensing.

The Other Story Is Cybersecurity

There is another issue that may prove just as important as the ownership disclosures.

Modern gambling regulators increasingly require operators to submit passports, corporate structures, financial statements, source-of-funds information and other highly sensitive data through digital portals. The Curaçao incident demonstrates the consequences when the regulatory system holding that information is compromised.

The CGA says it has strengthened security measures across its portal and that its investigation has not identified a compromise of its core technical infrastructure. However, the authority has acknowledged that information relating to operators and internal CGA documents was accessed.

For online casinos, this makes regulatory cybersecurity part of the compliance conversation. Operators may be required to provide increasingly detailed information to prove who owns them and where their money comes from, but regulators must also demonstrate that they can protect those records.

Casino Secrets therefore goes beyond another offshore gambling leak. Heading into 2027, it puts two questions at the center of online casino regulation: whether authorities can reliably determine who stands behind a gambling business, and whether they can securely protect the information required to prove it.

Sources Used - APA Style

Curaçao Gaming Authority. (2026, September). Follow-up on unauthorized access to the CGA online gaming portal. Curaçao Gaming Authority

Davies, R., & Peigné, M. (2026, September 26). Vast Casino Secrets leak exposes inner workings of offshore gambling firms. The Guardian. The Guardian investigation

Follow the Money. (2026, September 22). Curaçao's secretive gambling industry exposed in leak. Follow the Money

Casino Secrets. (2026). Investigating the offshore online gambling industry. Casino Secrets investigation