The Curaçao Gaming Authority (CGA) is responding to a serious data breach that has impacted its online gambling licensing portal. On Monday, the authority announced plans to launch a temporary replacement for the system starting Tuesday, following investigations into the breach that was detected on September 17.
Investigators from the CGA revealed that an unauthorized individual, identified as a security researcher from Germany, had gained access to the licensing portal and its associated database. The breach reportedly allowed the intruder to access and publish personal and confidential details of licence holders, with the unauthorized access occurring between December 2025 and September 2026.
The portal and database were managed by an external provider, which the CGA has now decided to sever ties with permanently. Consequently, the authority has taken the affected portal offline as it conducts its investigation.
In response to the breach, the CGA will implement a temporary portal on October 19 to facilitate ongoing licensing and supervisory duties. Plans are also in place to develop a new internally managed system. Certain components, including the internal system, digital seal, and licence register, have been identified for further work and security testing prior to the launch of the temporary system. These components are at this stage prepared for independent security evaluations. Adjustments to the client portal are also being made in preparation for security testing.
The CGA has reassured that the closure of the old portal does not affect the validity of existing licences, and all licensed companies will continue to uphold their regulatory responsibilities.
To address the data breach, the CGA has filed reports in Curaçao, Germany, and the Netherlands and has engaged specialist firms to help remove unauthorized material from online sources. An independent forensic investigation is underway to ascertain the breach's extent and guide further actions, including potential civil litigation.
This data breach occurs amid reforms in Curaçao's online gambling licensing and supervisory practices. In 2023, the Ministry of Finance directed the then Gaming Control Board—now the CGA—to reform its oversight mechanisms in light of international criticism regarding its previous master licence and sub-licence arrangement, alongside an increase in player complaints and negative media coverage. The new LOK gambling law, introduced in December 2024, replaced the old licensing framework and granted the CGA direct supervisory authority over operators.
As part of this reform process, the CGA has hired 14 specialists dedicated to licensing, supervision, and enforcement, aiming to reduce its dependence on external advisors and improve its operational capacity.
