The secrets of thousands of online casinos have been laid bare in a vast leak of data that could have seismic consequences for offshore gambling firms, including some accused of illegally targeting consumers around the world.
The Casino Secrets leak reveals tens of thousands of previously confidential files stored by the gambling regulator on the Caribbean island of Curaçao.
The files detail the inner workings of some of the world’s largest online casinos, including the crypto-focused Everton FC sponsor Stake.com and the Santeda network, which was exposed in an investigation by the Guardian and Investigate Europe in April.
Some of the businesses appear to be owned or operated by British citizens, while others, such as the Leicester City FC sponsor BC.Game, have previously been accused of targeting UK customers illegally.
The leak has rocked Curaçao, whose opaque licensing regime has transformed the former Dutch colony into a thriving but sometimes controversial hub for gambling firms, hosting more than 8,000 casinos, one for every 20 people living there.
A Berlin-based hacker, Lilith Wittmann, claims to have obtained internal documents by accessing a database kept by the Curaçao Gaming Authority (CGA).
The CGA has confirmed it was subject to “unauthorised access” of its portal.
Data published in the leak includes information about the owners of some of the world’s largest offshore casinos and details including the source of their wealth.
Companies whose data has been published include Santeda International, the global casino network traced by the Guardian and Investigate Europe this year.
The investigation found that casinos owned by Santeda appeared to have targeted vulnerable UK gamblers who were trying to quit, despite it having no licence from the Gambling Commission, which is illegal.
The investigation also uncovered a digital paper trail leading to a business called Upgaming, which is owned and operated by a group of Georgian businessmen.
At the time, lawyers for Upgaming said their client denied operating the Santeda network but the Casino Secrets leak has raised new questions about this claim.
Information submitted by Santeda to the CGA names a Georgian called Onise Chimakhidze as its owner.
It also gives Upgaming email addresses as contact details, while a cache of files submitted to the CGA refer to Upgaming in their filenames.
Lawyers for Upgaming said their client could not “speculate as to why a third-party has listed their contact details without further information, or without having seen the documents”.
They said this could be because Upgaming previously had a business relationship with Santeda, which has since ceased.
A document submitted in 2025 described a man named Torniki Kapanadze as Santeda’s finance chief. A LinkedIn profile shows a Tornike Kapanadze works for Upgaming. Lawyers for Upgaming said this was a common name in Georgia and noted the difference in spelling.
Santeda also extended six loans totalling €15,590,000 (£13,420,000) to Buda Capital, a Luxembourg-based company owned by a group of Georgians who own stakes in or are directors of Upgaming. Upgaming did not provide an explanation for this loan.
The lawyers said Upgaming believed it was “subject to a targeted campaign by various parties, including with vested commercial interests of their own”, without providing further explanation.
The leak also reveals data about Oddsbet, a betting company focused on “VIP” gamblers that was owned until 2025, the data suggests, by Robert Bostock, from Goole in the East Riding of Yorkshire.
Documents submitted to the CGA by Bostock’s company claimed that the source of his funds derived from “long-term crypto currency investments” and a £100,000 loan from another person based in the UK.
He sold the business for $240,000 in 2025, the documents suggest.
Lawyers for Bostock said the £100,000 loan was never drawn. They said the business only served customers outside the UK.
BC.Game also appears in the leak. The company has previously been accused of accepting business from UK customers, even after surrendering its licence to do so. This would be an offence under the Gambling Act 2005.
The leak also reveals information about Stake.com, the vast online casino that pulled out of the UK in 2025 after a string of controversies.
Stake’s Curaçao-registered company, Medium Rare NV, gave its owner as Serbian national Mladen Vučković, who declared assets of more than $1bn to the regulator in 2024.
Regulators questioned whether he owned the business, after finding millions of dollars to companies tied to Stake’s founders, Ed Craven and Bijan Tehrani. Neither appeared on the licence application, according to the investigative journalism platform Follow the Money, which first reported the findings.
But the Curaçao regulator still issued a licence, one example among several that Follow the Money said indicated that it failed to act on red flags about applicants.
The UK Gambling Commission said it could not comment on leaks.
“Illegal activity linked to gambling is a threat that we take seriously, and we work closely with partners to identify and disrupt those seeking to operate outside the regulatory framework,” it said.
The CGA said it could not answer questions about an “ongoing, complex forensic matter”.
It said it was “committed to transparency” and would issue further updates.
The Guardian has approached BC.Game and Stake.com for comment.
