Curaçao data breach names hidden owners at Stake and 1xBet

A Berlin-based cybersecurity researcher named Lilith Wittmann registered through the Curaçao Gaming Authority's licensing portal using the identity of a trust-office manager and held access to the regulator's system for nine months. The investigation, published by Dutch outlet Follow the Money, reviewed tens of thousands of documents including ownership declarations, passport records, tax filings, and license applications.

The breach identified roughly 800 owners linked to nearly 650 licensed gambling firms. Among them: Medium Rare NV, the Curaçao entity behind Stake, lists Serbian national Mladen Vuckovic as sole owner, with CGA auditors noting more than $1 billion in declared assets. CGA officials questioned whether Vuckovic held sole control, citing loans and payments connected to Stake founders Ed Craven and Bijan Tehrani, neither of whom appeared on the license application.

Records tied to 1xBet name Ihor Hniedash as owner and CEO of its Curaçao entity. CGA assessors, according to the report, suspected multiple beneficial owners and sought clarification on Hniedash's relationship to individuals publicly associated with the brand. The company received its Curaçao license in 2024.