On 17 September the Curaçao Gaming Authority disclosed that someone had gained unauthorised access to the online portal through which every company licensed on the island files. The regulator said the access had been contained and its source identified, that its core technical infrastructure was not compromised, and that it had not yet established what information was reached. Anyone affected would be contacted directly.

Six days later the scope became clearer from the other side. A Berlin-based researcher, Lilith Wittmann, said she had held access to the authority's systems since December 2025 and had obtained tens of thousands of confidential documents: ownership records, licence applications, the regulator's own assessments, passports, tax returns and financial information. The material was released through a coordinated campaign across publications in five countries, and she has said she intends to publish a full list of ultimate beneficial owners.

The same researcher claimed responsibility for a breach of the Malta Gaming Authority in March 2026.

We have not reviewed the material and will not be publishing anything from it. What follows is about why a leak from a Caribbean regulator is a Finnish licensing story.

The register this concerns

Curaçao's public register listed 616 active licences a day before the disclosure: 523 held by operators taking bets from players, and 93 by suppliers. Applications filed through that portal carry corporate records and a personal history form naming the people behind each company.

Reporting on the leaked documents states that the regulator granted licences in cases where questions about ownership were not answered, and without establishing whether the declared owners were the people actually in control. Entities reported as associated with several large offshore brands appear in the material. Those associations are as reported and we have not verified them.

Why Finland

Because Finland assesses applicants on reliability and suitability, and because the people behind a company are part of that assessment.

Around fifty gambling licence applications are with the National Police Board. Most are from companies based outside Finland. Each is evaluated on documents the applicant supplies: corporate register extracts, certificates, reports on the applicant and on the persons associated with it. The process is designed around disclosure by the applicant.

A leak of this kind produces the one thing a disclosure-based process cannot generate on its own: an independent record of who actually owned what, assembled by another regulator, at a time when the applicant had no reason to expect it would ever be read by a third party.

That is not an accusation about any Finnish applicant. It is a description of what has just entered the public domain in a market where suitability is the test.

The supplier timetable makes this sharper

Software licence applications open on 1 July 2027, and from 1 July 2028 a Finnish licensee may only run on software from a licensed supplier.

Ninety-three of the Curaçao licences are supplier licences. The B2B layer of this industry has historically been less exposed to ownership scrutiny than the operator layer, because suppliers are further from the player and further from the regulator. Finland closes that gap: from 2028 the supplier needs its own Finnish licence, assessed on its own suitability.

Any operator now selecting a platform, an aggregator or a payments partner for a Finnish launch is choosing a company that will be assessed in its own right within two years. Ownership history that was previously nobody's business becomes a procurement question.

What an applicant should be doing this week

  • Establish whether the group, any subsidiary, or any person named in a Finnish application has ever held or applied for a Curaçao licence, and under which entity.
  • Check that what was declared to Curaçao and what has been declared to the National Police Board describe the same ownership and the same people.
  • Ask the same question of every supplier in the Finnish stack, not just the platform.
  • Decide in advance how the group would respond to a media enquiry about material it has not seen and cannot verify.

The last one matters more than it looks. The documents are being released through journalists in several countries over a period of weeks. An operator that has not established its own position will be answering questions on someone else's timetable.

The awkward question nobody has answered

What a licensing authority may do with information that reached the public through a criminal act is not settled, and the Finnish authority has published no position on it.

A supervisor cannot unsee a fact. It can also not build a decision on evidence it has no lawful basis to use. Between those two there is a real question about how a suitability assessment treats a credible public claim that an applicant's declared ownership was not its real ownership somewhere else.

We have asked no one and we are not guessing. It is a question worth raising with counsel before it arrives in an information request.

What we do not know

  • What was in the material, beyond what has been reported. We have not seen it.
  • Whether any Finnish applicant appears in it.
  • Whether the National Police Board or the incoming supervisory authority will take any position on leaked material.
  • The full scope of the breach. The Curaçao authority has said its own investigation has not established it.

We will report on this again only when something is established rather than claimed.