A cyberattack disclosed last week by the Curaçao Gaming Authority (CGA) was carried out by a self-proclaimed “white hat” hacker who previously breached the Malta Gaming Authority’s (MGA) systems.

Berlin-based Lilith Wittmann, 30, said on social media Tuesday (September 22) that she and her collaborators gained access to internal CGA systems for nine months and “watched [the regulator] live at work.”

“Without the employees knowing about it, I could see who owns illegal online casinos, who finances them, and what the authority knew about their operations,” she wrote on X.

Wittmann’s CGA hack has already raised questions about the ownership structures of 1xBet and Stake, detailed Tuesday in a report by Dutch investigative website Follow the Money (FTM )—and Wittmann is teasing further revelations.

These include an alleged €250 million tax loophole connected to Platin Casino, which Wittmann describes as “Germany’s largest illegal casino,” along with claims that leaked documents show software provider SoftSwiss is closely connected to companies operating hundreds of illegal casinos.

The tiny Caribbean island of Curaçao has licensed online casinos since the dawn of the industry, operating a notoriously “light touch” approach to regulation. The model attracted numerous operators serving markets where they were not locally licensed, while ownership was often obscured behind Curaçao companies and trust offices.

Under pressure from the Netherlands , Curaçao has ostensibly abolished the old system—an unusual sub-licensing model that allowed a small number of private companies to extend their master licenses to large numbers of operators.

But the leaked documents raise questions about the rigor of that transformation, showing that CGA officials approved licenses even after their own assessments identified unresolved questions about ownership and other potential red flags, according to FTM.