CGA Exits SBC Lisbon as Lilith Wittmann Mocks Data Leak Response

The Curaçao Gaming Authority has withdrawn from SBC Summit Lisbon 2026 to focus resources on its investigation into unauthorised access to its online licensing system.

In a statement dated September 25, the CGA said the incident remains subject to forensic and regulatory review. The authority has contained the unauthorised access, secured the affected account and is working with independent cybersecurity specialists and relevant authorities.

The regulator also said it has filed reports with domestic and international authorities concerning information it says was unlawfully obtained from its online portal.

CGA Considers Legal Action Against Lilith Wittmann

The CGA is evaluating potential legal action against German security researcher Lilith Wittmann, who has been linked to the disclosure of information obtained from the regulator's licensing infrastructure.

The authority did not specify what legal claims it may pursue. It said it is also monitoring the publication of leaked material online and taking steps aimed at having the information removed.

The CGA's description of the information as unlawfully gathered represents the regulator's position while the investigation remains ongoing.

The authority has not publicly detailed the complete scope of the affected data or the full impact of the incident.

Despite redirecting resources away from SBC Summit, the CGA said its regulatory and supervisory activities continue without interruption.

Wittmann Responds With Sarcastic SBC Offer

Wittmann responded publicly to the regulator's announcement on X.

She joked that the CGA had been forced to cancel its "vacation in Lisbon" because of the incident and offered to take over the regulator's stand at SBC Summit.

Wittmann also suggested that she could help CGA clients with licence applications, describing herself sarcastically as an expert on Curaçao licensing after spending months examining the regulator's systems.

Her comments add another public dimension to a dispute that has moved beyond the technical details of the security incident and into potential legal action.

SBC Summit Lisbon takes place from September 29 to October 1, 2026 and is expected to bring together tens of thousands of gambling industry professionals, including operators, suppliers and regulators.

The CGA had been scheduled to participate alongside other international regulatory representatives before cancelling its attendance.

Investigation Remains Ongoing

The CGA has said that concentrating its resources on the forensic investigation is currently more important than participating in international industry events.

The regulator is assessing the potential consequences of the unauthorised access while coordinating with cybersecurity specialists and authorities inside and outside Curaçao.

It has not announced when the investigation will be completed or when further details about the affected information will be released.

The CGA said additional updates will be provided when appropriate.