WILLEMSTAD – A cybersecurity researcher gained access to the Curaçao Gaming Authority's licensing system after registering with the identity of a trust-office manager but using her own Gmail address and claiming to represent a fictitious company, according to an investigation published by Follow the Money.
The account of the breach raises significant questions about the cybersecurity and identity-verification procedures surrounding a government database containing passports, tax information, financial disclosures and confidential information about hundreds of gambling companies.
According to FTM, Berlin-based hacker and researcher Lilith Wittmann registered on the CGA website in December using the name of a Dutch trust-office manager known to the regulator.
However, she entered her own Gmail address.
She claimed to represent “DreamCatcher Private Foundation,” a fictitious entity she had created for the purpose of applying for a gambling license.
According to FTM, the discrepancy apparently went unnoticed and Wittmann was given access to the licensing portal within days.
Once inside, FTM reports that Wittmann uploaded software that enabled her to take control of the licensing portal and access information stored in the system.
The material she obtained included company ownership information, license applications and assessments produced by the regulator. It also contained passports, tax returns and sensitive financial information.
Wittmann had previously breached the Malta Gaming Authority and participated as a journalist in investigations into misconduct within the gambling industry, according to FTM.
She defended her decision to obtain and disclose the Curaçao information by arguing that the public had a legitimate interest in knowing who owns companies operating international gambling businesses.
FTM itself explicitly acknowledges that the source material was obtained through hacking.
The publication says its editorial decision to use the documents was based on what it considered the public interest in exposing allegedly exploitative and illegal practices associated with Curaçao's gambling sector.
FTM also says it established an important cutoff: it used only documents Wittmann obtained in December before FTM contacted her or knew about the CGA breach.
That distinction means the journalists say they analyzed material resulting from an independently conducted breach rather than directing Wittmann to obtain additional documents for their investigation.
Beyond the gambling revelations themselves, the incident raises another question for Curaçao authorities: how an outsider was apparently able to gain access to a regulatory system containing highly sensitive personal and financial data after presenting a fictitious organization and an email address that did not correspond with the identity being used.
Source: Follow the Money/Casino Secrets, David Davidson, Sjors Hofstede and Lukas Kotkamp; cybersecurity research by Lilith Wittmann; Curaçao reporting by Dick Drayer.