A large leak from the Curaçao Gaming Authority has exposed previously confidential information about thousands of offshore gambling businesses, including companies linked to Stake.com, BC.Game, and the Santeda network. The Guardian reported that the Casino Secrets files hold licensing documents, ownership information, and financial records submitted to the regulator, some of it relating to companies previously accused of operating in markets where they held no licence.
Berlin-based security researcher Lilith Wittmann obtained the documents, saying she got into the CGA’s licensing portal in December 2025 and stayed inside its systems for around nine months. The wider Casino Secrets investigation, run with Follow the Money and media partners across several European countries, says it analyzed more than 84,000 documents and traced ownership records connected to hundreds of Curaçao-licensed gambling companies. The CGA has confirmed the unauthorized access, with its own investigation into the full extent of the breach still running.
Santeda International takes up a good part of the Guardian’s reporting, having previously been investigated by the paper alongside Investigate Europe over allegations that its casino sites targeted UK gamblers without a UK Gambling Commission licence. Documents cited by the Guardian name Georgian national Onise Chimakhidze as Santeda’s owner and list Upgaming email addresses as contact details, with the Upgaming name turning up in other files submitted to the CGA too. Lawyers for Upgaming said the company doesn’t operate the Santeda network and suggested those contact details may date from an earlier business relationship.
Six loans from Santeda to Luxembourg-based Buda Capital, worth a combined €15.59 million, also appear in the leaked material, according to the Guardian. Buda Capital is owned by a group of Georgians who hold stakes in or serve as directors of Upgaming. Upgaming’s lawyers offered no explanation for the loans and said the company believes it is the target of a campaign involving parties with commercial interests.
Stake.com’s Curaçao business, Medium Rare NV, shows up in the files as well. The Guardian, citing reporting by Follow the Money, said Medium Rare declared Serbian national Mladen Vučković as its owner and that he reported assets exceeding $1 billion to Curaçao regulators in 2024. Internal records reportedly show CGA officials questioning whether Vučković was the sole owner after spotting payments and loans involving businesses connected to Stake founders Ed Craven and Bijan Tehrani, neither of whom appeared on the licence application. The CGA issued the licence anyway while those questions were still open, per Follow the Money.
BC.Game, which sponsors Leicester City, is another operator named in the report. The company has previously faced accusations that it kept accepting UK customers after giving up its Gambling Commission licence, and offering gambling to consumers in Great Britain without the required licence can breach the Gambling Act 2005. The Guardian said it approached both BC.Game and Stake for comment on the leaked material.
Oddsbet, a gambling business aimed at high-value customers, appears in the files too, owned until 2025 by British businessman Robert Bostock according to the Guardian. Documents submitted to the CGA said Bostock’s funding came from long-term cryptocurrency investments and a £100,000 loan, while the leaked records suggest he sold the business for $240,000 in 2025. His lawyers told the Guardian that the loan was never drawn and that the company only took customers outside the UK.
Follow the Money’s broader investigation turned up repeated cases where CGA officials had questions about company ownership or corporate structures during licence assessments. The regulator told FTM that Curaçao was moving from its old licensing system to the new framework under the National Ordinance on Games of Chance, and that operators were being given time to meet the new requirements rather than being rejected outright whenever questions remained open.
The CGA said it couldn’t address the Guardian’s questions about individual leaked documents while the breach remains an active forensic investigation. It has separately confirmed that the unauthorized access was contained and says it has added security and monitoring measures while working out exactly what was taken. The UK Gambling Commission also declined to comment on the documents, saying only that it works with partners to identify and disrupt gambling businesses operating outside the UK regulatory framework.