The Curaçao Gaming Authority (CGA) is taking action to address a significant data breach that has affected its online gambling licensing portal. On Monday, the CGA announced plans to initiate a temporary replacement for the compromised system starting Tuesday.
The breach was uncovered on September 17, when investigators discovered that a security researcher from Germany had obtained unauthorized access to the authority's licensing portal and its associated database. The CGA reported that this breach involved access to personal and confidential information belonging to license holders, with the unauthorized access occurring between December 2025 and September 2026.
The incident prompted the CGA to take the affected portal offline to conduct an investigation. Subsequently, the authority decided to cease operations of the existing portal and permanently terminate the services of the external provider that managed it.
To ensure that licensing activities and supervisory tasks can continue, the CGA will launch a temporary portal on October 19. This new system is being developed in-house, with careful preparation to ensure proper security. The authority has identified various components that require additional work or security testing before the temporary system goes live, including the internal setup, digital seal, and license register, which are all slated for independent security assessments. Adjustments to the client portal are also being made prior to these tests. The CGA reassured that while the old portal is being shut down, existing licenses remain valid, and licensed companies must continue to adhere to their regulatory obligations.
In an effort to mitigate the risks associated with the stolen data, the CGA has reported the breach and filed complaints with authorities in Curaçao, Germany, and the Netherlands. Specialized firms have been engaged to remove any compromised material that has surfaced online. An independent forensic investigation is currently underway to assess the breach's extent and guide further remedial actions, including the consideration of civil litigation.
This incident unfolds amid ongoing reforms in Curaçao's online gambling licensing and supervision processes. In 2023, the Ministry of Finance instructed the then Gaming Control Board, now the CGA, to overhaul the sector's oversight due to international criticisms directed at the previous master license/sublicense model, along with a rise in player complaints, negative media coverage, and obligations to the Netherlands. The new LOK gambling law, which became effective in December 2024, supplanted the old licensing structure, placing the CGA in direct supervisory control over operators. As part of these reforms, the CGA has incorporated external technology and regulatory experts while establishing an externally managed licensing portal in 2024 as a means of processing applications and oversight while building its internal capabilities. Since the commencement of this reform effort, the CGA has added 14 new staff specializing in licensing, supervision, and enforcement, aimed at reducing reliance on external advisory services.
