A vast leak from the Curaçao Gaming Authority has exposed confidential information belonging to hundreds of gambling businesses, raising awkward questions about offshore regulation and an even more basic one for online poker players: if a regulator cannot keep its own sensitive data secure, exactly who can?
Poker news is not always bracelets, seven-figure scores and another operator announcing its biggest series ever. Sometimes the story is about the businesses holding players’ money, the regulators overseeing them and what happens when the systems designed to protect sensitive information fail.
Poker Type covers poker warts and all. Our editorial policy separates commercial relationships from editorial coverage, and that means reporting the uncomfortable side of the industry rather than turning every operator story into an affiliate sales pitch.
The latest uncomfortable story comes from Curaçao.
A huge collection of confidential documents taken from the Curaçao Gaming Authority has been analysed and partially published as part of the Casino Secrets investigation, offering an extraordinary look inside one of the most important licensing jurisdictions in offshore online gambling.
And poker is part of that world.
What Is the Casino Secrets Leak?
Casino Secrets is an international investigative project based on material obtained from systems operated by the Curaçao Gaming Authority, or CGA.
The project says more than 84,000 Curaçao documents and over two terabytes of data were analysed, involving more than 1,000 iGaming companies. Tens of thousands of documents relating to Curaçao-licensed gambling businesses have subsequently become searchable through the project.
The material includes licence applications, company ownership records, corporate structures, financial information and details concerning the source of wealth of people behind gambling businesses.
That is not marketing material accidentally left in a public Dropbox folder.
This is the sort of information gambling companies are required to provide precisely because regulators need to know who is really behind an operation, where their money came from and whether they are suitable to hold a licence.
The Guardian reported this weekend that companies appearing in the documents include Stake.com, BC.Game and Santeda International, among numerous other gambling businesses.
There is no suggestion from the material we have reviewed that all companies appearing in the files have done anything wrong. Being named in regulatory documents is entirely normal for a licence holder. The story is how those documents became accessible in the first place, and what some of them appear to reveal about the licensing process.
Access Allegedly Continued for Nine Months
The Curaçao Gaming Authority initially announced on September 17 that it had discovered unauthorised access to its online gaming portal. It subsequently confirmed that an account had been created using a false identity in December 2025 and that unauthorised access continued until September 2026.
German security researcher Lilith Wittmann has said she was responsible for gaining access and worked with journalists investigating the material.
According to the CGA, the access came through the customer-facing portion of its portal rather than a compromise of its core technical infrastructure. The regulator says the vulnerability has been contained and a forensic investigation is continuing. That distinction matters technically.
For anyone whose confidential documents ended up outside the regulator, however, it may feel considerably less comforting.
Nine months is a very long time for an unauthorised user to retain access to a regulatory system containing some of the gambling industry’s most sensitive corporate information.
The Leak Goes Beyond a Cybersecurity Story
The documents have also raised questions about what the regulator knew when considering certain licence applications. The Guardian reports that Casino Secrets material includes cases where CGA officials queried ownership arrangements or other aspects of applications before licences were eventually granted.
Follow the Money, one of the organisations behind the investigation, has argued that some records show red flags being raised without ultimately preventing licences from being issued.
The CGA has not accepted every interpretation being placed on individual documents. It says the matter remains part of a complex forensic investigation and has said it will provide further information as facts are established. That is an important caveat.
A regulator asking questions during an application is not evidence by itself that the eventual licensing decision was improper. Due diligence is supposed to involve questions.
What the documents now allow journalists and regulators elsewhere to examine is what those questions were, how they were answered and what happened afterwards.
Why Curaçao Matters to Online Poker
Curaçao has spent decades as one of the major licensing centres for international online gambling.
Its licences have appeared at the bottom of countless casino, sportsbook and poker websites, particularly operators serving markets where locally regulated online gambling is unavailable, restricted or fragmented.
That still includes poker.
Ignition Poker currently states that it is owned and operated by Connaught Media B.V. and licensed by the Curaçao Gaming Authority under licence number OGL/2024/625/0719.
Poker Type has found no evidence that Ignition Poker itself is implicated in wrongdoing revealed by Casino Secrets, and its presence under the Curaçao regulatory system should not be treated as evidence otherwise. It does, however, demonstrate why a leak from this particular regulator matters to poker rather than only to online casino players.
When an online poker room tells players it is licensed and regulated, the regulator’s name is supposed to mean something.
Other Poker Operators Have Moved Elsewhere
Curaçao is no longer the automatic home for every offshore-facing poker business.
CoinPoker currently operates under a licence issued in Anjouan, while WPT Global says it is licensed by the Tobique Gaming Commission.
Those licensing arrangements carry their own regulatory questions and should be judged independently. Moving away from Curaçao does not automatically make an operator safer, just as holding a Curaçao licence does not automatically make one unsafe.
What has changed is the range of jurisdictions appearing beneath major poker brands. For players, that makes understanding who actually regulates a poker site increasingly important.
It also fits into a much wider online poker problem. The market is fragmented enough that even Daniel Negreanu recently had to travel from Las Vegas to Canada to play an international WSOP Online bracelet schedule, a situation we covered when looking at the fragmented state of regulated online poker.
The badge at the bottom of a poker website is not decoration. It determines which regulatory framework sits between the player and the operator when something goes wrong.
What Data Does a Gambling Regulator Actually Hold?
A gambling regulator does not merely maintain a spreadsheet containing operator names and licence numbers.
Curaçao licence holders can be required to provide corporate information, beneficial ownership details, compliance records, financial information and regulatory reports.
Current CGA licence conditions also require operators to provide several forms of ongoing reporting, including incident reports, player transaction reports and complaints information.
The rules further state that critical information concerning players, game transactions and financial transactions must remain accessible to the CGA through specified infrastructure.
That does not mean the Casino Secrets leak contains every Curaçao poker player’s hand histories, passwords or bankroll information.
There is currently no evidence that it does.
It does show why securing a gambling regulator’s systems matters far beyond protecting corporate paperwork.
Was Player Data Exposed?
Based on the information currently available, there is no evidence that Casino Secrets compromised poker-room account databases, login credentials, passwords or player balances.
The CGA has said it is still determining exactly what information was accessed and which individuals or organisations may have been affected. That means claims that players themselves were hacked would currently go beyond the evidence.
It would also be wrong to conclude that player information was definitely untouched.
Curaçao’s regulatory framework gives the CGA access to reporting involving player transactions and complaints. Until the forensic investigation establishes precisely which systems, files and records were accessible, there is a gap between “no evidence of player account exposure” and “player information definitely could not have been exposed.”
Those are not the same thing.
Players concerned about choosing an online poker site should still consider licensing, withdrawal history, security procedures and whether an operator is permitted to serve their jurisdiction. Poker Type’s responsible gambling guidance also makes clear that the presence of an operator on a poker website does not replace a player’s responsibility to check where and how that operator is regulated.
So How Safe Is Your Data With an Online Poker Operator?
There are really two answers.
Your information held directly inside an established poker operator’s systems is not shown by this leak to have been compromised. Casino Secrets concerns information obtained from the regulator’s environment, not proof that someone broke into poker clients and extracted player databases.
But players do not give sensitive information to only one organisation.
A passport used for KYC, transaction information, source-of-funds records, complaints and account information can move through operators, payment processors, compliance companies and regulators.
Every extra organisation in that chain creates another place where information has to be protected properly. That may be the most important lesson from Casino Secrets.
Players are regularly told to use strong passwords, protect their accounts, enable additional security and be careful where they send identity documents. Those are sensible precautions.
The uncomfortable question is what happens after the player has done everything right.
If an operator sends sensitive information to a regulator because the law requires it, and the regulator’s portal can then be accessed without authorisation for months, how much control does the player really have over where their information ultimately ends up?
For now, there is no evidence that the Casino Secrets investigation has exposed poker players’ passwords or bankrolls. There is plenty of evidence that confidential gambling-industry information escaped from somewhere players, operators and governments were entitled to expect would keep it secure.
So perhaps the question is no longer simply whether your poker site is safe.
It is how safe the entire chain behind it really is.
External source: The Guardian, “Vast Casino Secrets leak exposes inner workings of offshore gambling firms,” September 26, 2026.
