Curaçao gaming authority experienced unauthorized access to their portal

[CryptoBuds]

So what is the ultimate beneficiary data going to do?
Casino owners still register with a lawyer office in Cyprus or whatwver. It's not worth much really. They have the means to hide themselves behind these tricks. So long as money is a thing these tricks will also exist.

This is not merely any folder of PDF containing name and address of few companies.
It store casino's system architecture and network topology. It also includes RNG certification and B2B software audit logs, as well as hot & cold crypto wallet registers and bank account IDs, etc.

While hacker may not need to know exactly which Cyprus office processed paperwork, the situation changes once they gain access to casino's open API environment and database schema. With this data they could easily develop zero day exploit, opening door to direct ransomware attack or theft of player database.

[Dr.Bitcoin_Strange]

Everything is not all about money so as individuals varies to different things.

For black hat hackers/scammers like that, every hack is actually about money to them but it can be direct or indirect, like this case now, what ever information they have collected will still serve them a purpose that will earn them money at last but that's if they succeed with using the information they have to scam or blackmail their targets. Before hackers attack like that, they already have a purpose in mind which is definitely going to lead them to succeed in what they want to start or what they are already doing. So, it's actually about money.

[buwaytress]

Well, there goes all our information And this is just ONE reason I will never do KYC online, especially not at a crypto casino who I cannot say will ever not share my info.

I have to, because of where I live, and I know I'm quite relaxed about KYC for a couple of casinos or so (there is a relationship I have with them) but you have the right mentality here. I can't say enough just how shady the whole business is (KYC, not casinos, that's... a different beast). And how poorly most systems and databases storing our information is.

I keep my passports on low expiry for this reason (so when/if it's leaked, it's usually expired) but if we think all the compromised sites and services are a sign, we're still far from the truth because there are so many compromised servers out there undiscovered. For as long as people leave passwords on post-its, and IT departments fall for company phishing drills, well...

[DubemIfedigbo001]

This information in the hacker's hands can expose offshore networks, identify famous people or even those responsible for famous casinos, this is very dangerous. If a person’s data being leaked is already a problem, imagine then the data of people who are known to potentially have a lot of money.

Then there is impersonation, if they have real data like ID cards, signature, pictures and address of them, they can use these data to defraud others or their allies who may think they're in communication with real persons. We know a lot is possible with AI, when so much accurate information is on the loose, it becomes more convincing to assume your are having a legitimate conversation, not knowing it is a scam attempt.

This further validates the fact that KYC is putting your identity and sensitive data at risk of being leaked to scammers when they get the right technology to breach systems of agencies holding them.

[PX-Z]

... What are the hackers targeting to get from such place, licensed casino's details, or the are more data saved in their database other than what the casinos give to them as part of regulatory requirements as I believe money can't be kept in their online portal.

Right, but thats not always the case. Personal info, or probably business info too, especially these info were from casino owners. Phishing emails, and impersonifications, so many got victims because of these method actually.

Imagine, a successful phishing for casino owners using those hacked emails/info, admin accounts got compromised after, and you know what will be the next.

Idk, what info are their aside from personal info, but im sure they are confidential and very important for those hackers to be used later.

[CryptSafe]

I believe this attack was just for data information and nothing much because the hackers can not include casino to their data base to bypass licence fees and all of that, if they dare that, they could be caught via the casino they have added to the data base which would have been easier for the Curacao team to easily identify through their mechanism put in place but I think the major concern is data theft by the hackers because that is the only reason which could prompt such an attack on their platform.
Most of these happens when there is possibly a battle for supremacy within the casino world and owners of casinos are secretly trailed and also monitored by their opponents to get more information about them and may be they have gone extra miles to launch this attack on the Curacao gaming platform to get information of what they are looking for. This is one problem with KYC as ones information CV an be targeted at any time as long as the availability is guaranteed.

[Ayers]

Well, there goes all our information And this is just ONE reason I will never do KYC online, especially not at a crypto casino who I cannot say will ever not share my info.

I keep my passports on low expiry for this reason (so when/if it's leaked, it's usually expired) but if we think all the compromised sites and services are a sign, we're still far from the truth because there are so many compromised servers out there undiscovered. For as long as people leave passwords on post-its, and IT departments fall for company phishing drills, well...

Most average user tend to believe that simply because they have submitted their KYC to reputable casino, the company is safeguarding their data with military grade security.

While your trick of keeping passport's expiry date short is quite clever but its impact on identity thieves is not rendered completely nil. Because doxxing and synthetic ID fraud do not cease even after term expires. When hackers sell leaked KYC file in batches, they don't just use passport number. They include your full name, DoB, permanent address, biometric photo, signature all together.

They could alter number of your expired passport or use its basic data to create synthetic identity and fake account on any offshore casino. Moreover when targeting victim on dark web or through spear-phishing attack then it makes absolutely no difference to criminals whether document is expired or still valid.

[Smartprofit]

Yes, in the evil hands of the 21st century's new "Professor Moriarty," such data is a powerful weapon!🙋

It immediately becomes clear that the blockchain is transparent and the data cannot be deleted... If attackers obtain the data of the beneficiaries of these online casinos, they will be able to trace the entire chain of their cryptocurrency transactions. Modern analytical software makes this possible. The entire detailed map of their financial empires will be right before their eyes. Blackmail is then possible (my favorite Conan Doyle Sherlock Holmes story, "The End of Charles Augustus Milverton,"🧐 immediately comes to mind). This data can also be sold to competitors. I've read that online casinos (even licensed ones) often operate in "gray areas." This is a potential vulnerability. New information allows competitors to eliminate their rivals.

This whole story once again demonstrates that centralization is evil, and KYC is an absolute evil.  It's quite possible that this situation will push online casino executives to abandon licensing altogether. Since it's becoming unclear which business model carries the greatest risks... Perhaps online casinos will begin to abandon Curaçao licenses en masse. After all, there are viable alternatives, such as Anjouan or Costa Rica.

[Fortify]

I stumbled upon this news today, which was made about 5 days ago, but I have a question regarding this. Curaçao is a gaming licensing authority. What are the hackers targeting to get from such place, licensed casino's details, or the are more data saved in their database other than what the casinos give to them as part of regulatory requirements as I believe money can't be kept in their online portal.

It seems obvious what they're trying to do, but there could be many different types of hacker that have targeted this information and we won't necessarily ever know their motives. You might have "white knight" type hackers who are purely curious about gaining access to information through holes in security or maybe even seeking this information out of some sort of social justice campaign. Then you have the nefarious hackers who might try to use this information to blackmail or even kidnap the owners of these highly lucrative casinos, maybe looking for other flaws in the security chain to access the funds. It could be nation states like North Korea who are always hunting for juicy targets, a group or even lone individuals. They've probably been under relentless attack for decades but somebody now has managed to break through, maybe there have been undisclosed leaks of the same information before. We can only speculate but it's the company representatives that are now exposed when they might previously have been hidden behind secrecy. Transparency might actually be better.

[Patikno]

Data hosted on portal of regulator like CGA far more valuable than money for cybercriminal and black hat hackers!
Following introduction of new LOK framework in Curaçao now CGA collects ultimate beneficial owner data from casino operator.

This mean those offshore and anonymous casino who were previously operating by concealing their identities behind shell company. Now they have to submit real name, passport copy, residential address, bank reference letter, document regarding source of wealth to CGA portal.

They can use this data to blackmail casino owner or sell it to rivals & law enforcement agency on dark web for $$

I completely agree with you; personal information and data are frequently traded on the dark web, let alone data belonging to a large corporation. From what I understand, they usually sell this kind of information on breach forums, or dark web forums. So, it is quite possible that the hackers specifically targeted CGA's data because there is actual demand for that information. Selling copies of the data could yield a significant profit for the hackers, or they might continue selling it to multiple buyers over time.

[salad daging]

A female journalist from Germany named Lilith Wittmann accessed a portal to the Curacao gambling authority, she went undercover and infiltrated and took the documents.

And this is what Wittmann did to get that information.

To uncover the people behind Curaçao’s gambling industry, Wittmann first needed access to the regulator’s licensing portal.
In December, Wittmann registered on the Curaçao Gaming Authority’s website using the name of a Dutch trust office manager known to the regulator, but entered her own Gmail address.
She claimed to represent DreamCatcher Private Foundation – a fictitious firm she had invented for the purpose of applying for a gambling licence.

The fact Wittman had used her personal email address apparently escaped scrutiny. Within days, she was granted access to the regulator’s portal.
Once logged in, the hacker uploaded software that allowed her to take control of the licensing portal and gain access to all information and documents stored there.

He has also written his own articles on this subject. https://www.ftm.eu/articles/curacao-secretive-gambling-industry-exposed-in-leak?share=mDp6E%2F1O61iKsEpRxMLip%2FhDbatWSDHarw2IIeBzZ0JRKuTagfPxZ6O2cPAenu4%3D
In his also reveal 1Xbet and who is the owner Stake.com actually, what happened was not Eddie or Bijan Tehrani but his original owner was Mladen Vuckovic according to data from the CGA.

He also released this site for anyone can view the document. https://casinosecrets.lol/
Starting from, who is the original owner, license, invoice, domain and many important information has been revealed on this site.

He was also asked by one of the community if he was not afraid to do this?
He responded in the public interest.

- https://x.com/LilithWittmann/status/2102652495432712686

[Davidvictorson]

Data hosted on portal of regulator like CGA far more valuable than money for cybercriminal and black hat hackers!
Following introduction of new LOK framework in Curaçao now CGA collects ultimate beneficial owner data from casino operator.

This mean those offshore and anonymous casino who were previously operating by concealing their identities behind shell company. Now they have to submit real name, passport copy, residential address, bank reference letter, document regarding source of wealth to CGA portal.

They can use this data to blackmail casino owner or sell it to rivals & law enforcement agency on dark web for $$

Very spot on.
It seems to me that these hackers are very intelligent and smart and are always a step ahead.
Sadly, their brilliance is channeled towards mischievous and damming activities.
I am beginning to think that maybe some people just like to be the villain in life's story.
It is not just about money or wealth for them, may about who wins the most villain Person Award of the Year.

[Hispo]

If I had to give an opinion on this case, I would say that information about millions of gamblers is far more valuable for hackers than information about hundreds or thousands of casinos.
Still, this is quite worrying, as this information which was targeted by those hackers has enough value for it to get sold in the dark web, and it could be used for spear fishing against casino operators, possibly costing millions of dollars in the case s single casino operator fell for it.

This will be set as an example on why it may be important to have casinos which does not necessarily depend on regulators in order to operate legally.

[MRY]

Data hosted on portal of regulator like CGA far more valuable than money for cybercriminal and black hat hackers!
Following introduction of new LOK framework in Curaçao now CGA collects ultimate beneficial owner data from casino operator.

This mean those offshore and anonymous casino who were previously operating by concealing their identities behind shell company. Now they have to submit real name, passport copy, residential address, bank reference letter, document regarding source of wealth to CGA portal.

They can use this data to blackmail casino owner or sell it to rivals & law enforcement agency on dark web for $$

I completely agree with you; personal information and data are frequently traded on the dark web, let alone data belonging to a large corporation. From what I understand, they usually sell this kind of information on breach forums, or dark web forums. So, it is quite possible that the hackers specifically targeted CGA's data because there is actual demand for that information. Selling copies of the data could yield a significant profit for the hackers, or they might continue selling it to multiple buyers over time.

File circulation on the dark web happens because the financial value of each consumer profile is extremely high. The targeting of big players is well thought out strategy, as there is always a group of criminals prepared to accept high value data leaks. The duplication of files is a way for criminals to earn money several times over without investing any more cash.

[Alphakilo]

If I had to give an opinion on this case, I would say that information about millions of gamblers is far more valuable for hackers than information about hundreds or thousands of casinos.
Still, this is quite worrying, as this information which was targeted by those hackers has enough value for it to get sold in the dark web, and it could be used for spear fishing against casino operators, possibly costing millions of dollars in the case s single casino operator fell for it.

This will be set as an example on why it may be important to have casinos which does not necessarily depend on regulators in order to operate legally.

This information hack could be used for different reasons such as hackers posing with the information they have for believability to unsuspecting victims who think the source is legit. Hackers always have a reason for doing anything like this and they can fake the information the get to scam other casinos into believing them or even the customers into believing they are so valued and thus lose their guards because documents prove legit.
I wonder what is being done about this, because for a license agency to be hacked is way worse than a casino or the customers to be hacked.

[noorman0]

I believe there are some casino employees who lack competence when it comes to handling unusual requests. Such portals essentially store all the casino's information; and as far as I know, casino founders typically keep their identities private. Consequently, we can foresee potential attacks targeting the casinos themselves (such as doxxing threats) rather than just the users.

[DPHOR]

I believe there are some casino employees who lack competence when it comes to handling unusual requests. Such portals essentially store all the casino's information; and as far as I know, casino founders typically keep their identities private. Consequently, we can foresee potential attacks targeting the casinos themselves (such as doxxing threats) rather than just the users.

Most of the hack we are hearing today could come from internal attacks, that is where trust come in because many people who are being employed could either tends to be good while at the back turned to be the one who is hurting them.
Usually most of the people out there are usually very good In trying to sell some information that concerns to the casino, although I do not also believe that they would be storing funds over there on their site.
The most important thing is that if they could track internal to know those who get themselves involved in such activities because that usually from internal attack and not external.

[Agbamoni]

I do have this mentality that gaming authorities have information that makes them unique and totally different from the others. Curaçao gaming has been one of the best gaming authorites out there. These people are looking for private information, leaks that will expose the operators, and the KYC information obtained from casinos under their regulation. I can't tell for sure, though.

[Nwada001]

Data leaks are a real problem, they have become widespread. Moreover, in most cases, the data is sold by the employees themselves, and the hacker attack is just a cover. At least in Russia, this happens in most cases. Perhaps it’s different on this island, but it means they failed to ensure data protection, which means casinos will take this into account when purchasing a license in another jurisdiction (even if it’s more expensive).

I fear employers more than the chances of our data getting leaked by hackers. I always feel this insecurity that once we submit our data to any platform, there is a higher chance that some of the employees can sell it out before hackers will attempt to breach their system, which can explain why we might not hear about a platform data bridge and still get some sort of suspicious mail from scammers.

[Dogedegen]

I stumbled upon this news today, which was made about 5 days ago, but I have a question regarding this. Curaçao is a gaming licensing authority. What are the hackers targeting to get from such place, licensed casino's details, or the are more data saved in their database other than what the casinos give to them as part of regulatory requirements as I believe money can't be kept in their online portal.

https://gamingcontrol.spin-cdn.com/media/general_publications/20260917_press_release_cga_17092026.pdf

Many things and many reasons, money is not directly stolen in hacking situation that is very rare. If we consider the simple social engineering hacks, often they involve manipulating the user to do some activity to get money so money is not directly being taken even in those cases. In stuff like this it can be good information that can be used to impersonate real casinos with real licenses, or it can be used to blackmail them. It depends on what data is taken exactly and how much it reveals.

Data hosted on portal of regulator like CGA far more valuable than money for cybercriminal and black hat hackers!
Following introduction of new LOK framework in Curaçao now CGA collects ultimate beneficial owner data from casino operator.

This mean those offshore and anonymous casino who were previously operating by concealing their identities behind shell company. Now they have to submit real name, passport copy, residential address, bank reference letter, document regarding source of wealth to CGA portal.

They can use this data to blackmail casino owner or sell it to rivals & law enforcement agency on dark web for $$

Yeah this can be pretty valuable data if they got a lot of it. It is also an example why submitting or storing so much data online is bad, even in situations where it is required like for regulators of licenses like this. They should verify the data upon recipient and then store it offline as an archive. It should not be accessible like this.