Curaçao Regulator Confirms Nine-Month Breach of Gambling Licence Portal

The Curaçao Gaming Authority said on October 19, 2026 that a security researcher from Germany accessed its online gambling licensing portal without authorization between December 2025 and September 2026 and published data and confidential information belonging to licence holders, and that a temporary replacement portal was scheduled to launch the same day.

In a press release, the regulator said it discovered on September 17, 2026 that the individual had gained access to the portal without proper permission beginning in December 2025. According to the investigations carried out, the unlawful access took place between December 2025 and September 2026 and affected the licensing portal and its database, which were managed by an external company.

The CGA said the breach “resulted from criminal conduct by a person who accessed the portal without authorization and took information from it.”

Response to the Breach

The regulator said it has filed complaints and reported the incident to authorities in Curaçao, Germany and the Netherlands. It has also hired specialist companies to remove the information available on the internet and commissioned an independent technical investigation to establish the impact and consequences of the attack. The CGA said it is considering civil legal action and remains in regular contact with the sector.

When the breach was discovered in September, the CGA first carried out an internal investigation and strengthened its security measures. The portal was then taken offline for an external investigation.

In its September 17, 2026 statement, the CGA said the unauthorized access had been contained and its source identified, and that its service provider had commenced a forensic investigation. It said the investigation had not at that stage identified any compromise of the Authority’s core technical infrastructure, and that affected parties would be notified directly where the investigation determined their information may have been affected.

Temporary Portal Replaces Retired System

On October 7, 2026, the CGA announced it would permanently stop using the existing licensing portal and end its use of the provider’s regulatory services. The regulator had decided not to reopen the portal and instead put a temporary solution in place.

The temporary portal was scheduled to launch on October 19, 2026, supporting the continued handling of licence applications and other supervision matters managed through the portal. The licence register and the digital seal system were also scheduled to become available with it; the digital seal is intended to show that a website holds a CGA licence.

The CGA said the internal system, digital seal and licence register were ready for security checks by independent specialists, while adjustments were being made to the client portal, with security testing to follow once those are complete. Preparation also includes checks for weaknesses that could allow unauthorized access and checks that the portal works properly for both users in the sector and CGA staff.

The regulator said closing the previous portal does not invalidate existing licences and that companies holding a CGA licence must continue to meet their obligations. Alongside the temporary portal, the CGA is preparing to develop and manage a new portal.

Reform Behind the External Portal

In 2023, the CGA, then known as the Gaming Control Board, began reforming the online gambling sector under instructions from the Minister of Finance. Until then, its supervision had focused mainly on local gambling activities, including casinos, number games, Bingo and Bon Ku’né. The regulator said Curaçao had faced considerable international criticism over the conduct of online gambling companies operating from the island, and that improving the country’s international reputation was one of the reform’s aims.

The CGA said the factors behind the reform included agreements with the Netherlands under the Country Package, a growing number of player complaints and negative media coverage, as well as the CFATF assessment of Curaçao that took place in June 2024. The Ministry of Finance decided in the second half of 2023 to begin the reform rather than wait for the LOK, the new gambling law that came into force in December 2024.

The regulator said it initially brought in external parties with experience in technology, licensing and supervision and selected an externally managed portal for licence applications and approvals, with the intention of moving to an internally managed portal at a later stage. The CGA itself remained responsible for licensing and supervision.

Since the start of the reform in 2024, the CGA said it has hired 14 employees, mainly for licensing, supervision and enforcement, with the aim of building expertise in Curaçao and gradually reducing reliance on external advisers. Under the LOK, Curaçao moved away from the master licence and sublicence system and the CGA directly supervises online gambling operators. The LOK approaches its second anniversary on December 24, 2026.