Curaçao gaming authority experienced unauthorized access to their portal

[Chibit01]

I stumbled upon this news today, which was made about 5 days ago, but I have a question regarding this. Curaçao is a gaming licensing authority. What are the hackers targeting to get from such place, licensed casino's details, or the are more data saved in their database other than what the casinos give to them as part of regulatory requirements as I believe money can't be kept in their online portal.

https://gamingcontrol.spin-cdn.com/media/general_publications/20260917_press_release_cga_17092026.pdf

[eternalgloom]

Data hosted on portal of regulator like CGA far more valuable than money for cybercriminal and black hat hackers!
Following introduction of new LOK framework in Curaçao now CGA collects ultimate beneficial owner data from casino operator.

This mean those offshore and anonymous casino who were previously operating by concealing their identities behind shell company. Now they have to submit real name, passport copy, residential address, bank reference letter, document regarding source of wealth to CGA portal.

They can use this data to blackmail casino owner or sell it to rivals & law enforcement agency on dark web for $$

[alegotardo]

I stumbled upon this news today, which was made about 5 days ago, but I have a question regarding this. Curaçao is a gaming licensing authority. What are the hackers targeting to get from such place, licensed casino's details, or the are more data saved in their database other than what the casinos give to them as part of regulatory requirements as I believe money can't be kept in their online portal.

They were looking for "digital gold",  but it is not about crypto, it is about high value confidential informations.
A regulatory body has a lot of data from casinos and some of it never should become to public.... passports and identification documents of casino owners, directors, shareholders, beneficiaries.... their tax and financial information.

This information in the hacker's hands can expose offshore networks, identify famous people or even those responsible for famous casinos, this is very dangerous. If a person’s data being leaked is already a problem, imagine then the data of people who are known to potentially have a lot of money.

[casey15]

While money can be a big motivation but that is necessary not the o my goal of hackers. As long as there are valuable information,then it is a target.
Curaçao being a licencing body will hold a lot of sensitive Information regarding various companies. This in itself may not be so important or valuable to you to it is valuable to them and to the hackers. Hacker will definable not waste so much time in things that do not benefit them.
The Information is the "money" and if gotten, they can be sold to other people illegally for huge sum of money. The target may also not casinos records, it may be the Curaçao body itself. Even if it was a portal that got compromised you never can tell the amount of information that has been exposed and how valuable and critical these information are

[Iranus]

If a person’s data being leaked is already a problem, imagine then the data of people who are known to potentially have a lot of money.

Indeed, when casino operators apply for license and submit regulatory report, they are required to file high risk KYC data regarding their player, as well as AML report. This portal accommodates an extensive archive of verification file for B2B and B2C shareholder, key personnel and their players.

Hacker could subsequently exploit this KYC data to carry out targeted identity theft and spear phishing attack.

[Dave1]

They might able to get the name of the owners of casinos that they have approved or in the process of approval. So that is a high value target for them, as they can used it to black-mail or even used that data for whatever purpose they want to.

They can impersonate that person and make deals or even to run a scam. And so with this, it is a classic example of criminals wanting to get those personalities and maybe later used it as a leverage in their favor.

So this is really bad for the gaming industry.

[Nrcewker]

Data hosted on portal of regulator like CGA far more valuable than money for cybercriminal and black hat hackers!

Yes as we know, Curacao is a gambling licensing provider, so money wouldnt be the reason for the security breach mentioned in the OP. The main reason for this breach might be that the hackers are trying to access regulatory or sensitive business data held by the licensing operator.

Depending on what the hackers were trying to access they could probably obtain information related to KYC/AML reports, corporate and ownership details of the casinos etc. But the main issue is, how can a popular licensing company’s security be so weak? This really raises serious concerns regarding the casinos associated with this operator.

[danherbias07]

Probably information from the gambling sites. Not the gamblers. Yet.

The license application might contain information we don't see in the gambling sites' white papers. I doubt it is about the money. They may want something that will help them penetrate the gambling sites' security, and the best way to get critical information is through those license applications. 
I hope they work fast on identifying what was taken from them because this can become a larger problem if those are sensitive items.

[acroman08]

This mean those offshore and anonymous casino who were previously operating by concealing their identities behind shell company. Now they have to submit real name, passport copy, residential address, bank reference letter, document regarding source of wealth to CGA portal.

Yeah, I saw an article about this yesterday, and if I remember correctly, this hack revealed one of the co-owners of 1xbet and the sole owner of stake(at least according to the article), who was previously unknown to anyone because it was not publicised. This incident could push them to pay taxes, if they hide the income they get or even face legal issues(I'm not certain) from which ever government they are under.

Here's the article I saw yesterday
https://ua.news/en/world/khakerka-rozkrila-prikhovanikh-vlasnikiv-gralnogo-biznesu-kiurasao

[CucakRowo]

B2B providers are required to regularly submit info such as game certification, RNG test report, server architecture diagram, infrastructure audit logs etc to CGA portal. It contain all the information regarding type of operating system the casino uses, such as Linux or Windows version. As well as their database system, whether it is PostgreSQL, MySQL or Redis.

Once hacker obtain Sensitor server configuration report from licensing portal, they can easily uncover casino's core gaming server and platform backdoor. So, these logs are actual blueprint for hackers.

Just imagine how much easier job become for robber if, before attempting any bank heist, they get their hands on exact blueprint of that bank's vault, CCTV camera, alarm system and secret lock on back door! Exact same thing happens in this case of cyberattack as well.

[Darker45]

But the main issue is, how can a popular licensing company’s security be so weak? This really raises serious concerns regarding the casinos associated with this operator.

It’s not even just a licensing company. The Curaçao Gaming Authority is the Curaçao government’s lead agency that implements regulations, laws, and other policies relating to both land-based and online gambling. It’s a powerful government body which supervises which casino is compliant and which isn’t.

Ironically, however, if it’s like in ours here, nothing is expected much from the government in securing records and portals.

There needs to be a serious review after this. There might be companies applying for license that are suddenly approved without their documents and other requirements submitted or scrutinized yet.

[Kelward]

They might able to get the name of the owners of casinos that they have approved or in the process of approval. So that is a high value target for them, as they can used it to black-mail or even used that data for whatever purpose they want to.

They can impersonate that person and make deals or even to run a scam. And so with this, it is a classic example of criminals wanting to get those personalities and maybe later used it as a leverage in their favor.

So this is really bad for the gaming industry.

Your summary of why this unauthorized access into Curacao portal happened makes a lot of sense because ordinarily somebody can wonder why anybody would bother to hack into a system where they won't steal money, it shows that stealing valuable information is as good as stealing money. Casino owners and their partners must be very rich people so getting personal sensitive information about them can be used to monitor and blackmail them also using the sensitive information to impersonate them cannot be ruled out. It could also be that the target was because of only one individual but I'm glad that Curacao's team was able to contain it, I hope that extensive damage has not been done before the containment

[alani123]

Data hosted on portal of regulator like CGA far more valuable than money for cybercriminal and black hat hackers!
Following introduction of new LOK framework in Curaçao now CGA collects ultimate beneficial owner data from casino operator.

This mean those offshore and anonymous casino who were previously operating by concealing their identities behind shell company. Now they have to submit real name, passport copy, residential address, bank reference letter, document regarding source of wealth to CGA portal.

They can use this data to blackmail casino owner or sell it to rivals & law enforcement agency on dark web for $$

So what is the ultimate beneficiary data going to do?
Casino owners still register with a lawyer office in Cyprus or whatwver. It's not worth much really. They have the means to hide themselves behind these tricks. So long as money is a thing these tricks will also exist.

[Zlantann]

I stumbled upon this news today, which was made about 5 days ago, but I have a question regarding this. Curaçao is a gaming licensing authority. What are the hackers targeting to get from such place, licensed casino's details, or the are more data saved in their database other than what the casinos give to them as part of regulatory requirements as I believe money can't be kept in their online portal.

https://gamingcontrol.spin-cdn.com/media/general_publications/20260917_press_release_cga_17092026.pdf

Where the investigation determines that information relating to individuals, applicants, licensees, or other stakeholders

At this age personal information is priceless. This is why companies do everything possible to protect information and hackers try hard to access it.  All this data is important and can be sold or used for illegal activities. Don't also forget that some of the owners of casinos want to remain anonymous. They would do everything possible to maintain their privacy.

https://gamingcontrol.spin-cdn.com/media/general_publications/20260917_press_release_cga_17092026.pdf

[viljy]

Data leaks are a real problem, they have become widespread. Moreover, in most cases, the data is sold by the employees themselves, and the hacker attack is just a cover. At least in Russia, this happens in most cases. Perhaps it’s different on this island, but it means they failed to ensure data protection, which means casinos will take this into account when purchasing a license in another jurisdiction (even if it’s more expensive).

[eternalgloom]

So what is the ultimate beneficiary data going to do?
Casino owners still register with a lawyer office in Cyprus or whatwver. It's not worth much really. They have the means to hide themselves behind these tricks. So long as money is a thing these tricks will also exist.

hmm you are right,

In the past, by paying only ~$5000, it was possible to operate any corporate structure using any nominee director, thereby keeping one's own name off company records. But that dirty game is officially over now!

Under LOK Act, GCA will no longer passively accept documentation involving anonymous shell companies and nominee shareholder.
To obtain direct license, individuals must not only supply notarized copies of their passport, biometric verification, POA, bank reference letter, SoW etc. But also that individuals should hold 10% or more of the company's share.

So there is no longer any opportunity to acquire new compliance clearance using signature of a dummy Cypriot nominee lawyer.

[leea-1334]

Well, there goes all our information And this is just ONE reason I will never do KYC online, especially not at a crypto casino who I cannot say will ever not share my info.

But no,,, I am not without lessons. The reason I am so anti-KYC was a mistake I made early in crypto where I KYC myself for an ICO. Guess what it got 'stolen' and I had to answer a hell lot of questions from my bank as it was apparently used

In the past, by paying only ~$5000, it was possible to operate any corporate structure using any nominee director, thereby keeping one's own name off company records. But that dirty game is officially over now!

That is something I was not aware of, that it changed. Still does not increase my confidence,,, these guys always find a loophole 

[SportbetOne]

...this hack revealed one of the co-owners of 1xbet and the sole owner of stake...

Targeting UBO filings is the real goldmine here. Unmasking the actual individuals behind multi-billion dollar offshore brands gives hackers massive leverage for extortion and targeted spear-phishing that no shell company can shield them from.

[Perfectbaby]

What you should also think is that how much do they charges to issues out operational license.
Again, it is only those that won't afford to pay the operational license could be the one who may likely want to hack their platform in other to have access to operational license. But one thing for sure is that, they may possibly noticed those people who gain access to their site and to licenses they do not authorized. Of course no money that would be leave on their platform because I believe they definitely have other means of storing their assets being charged from gambling sites for issuing and operating license.

[gracreavix]

Hackers have various reasons for hacking. But majority is money, while other go for something more valuable than money which in my opinion is reputation. I think that is what they are after in this case. They can attack multiple casinos by just targeting the head of the operation. Once the head is compromised then the body follows. So only pointing it to just money is you overlooking other aspect of how they operate. Everything is not all about money so as individuals varies to different things.