The Curaçao Gaming Authority (CGA) is taking steps to address a significant data breach impacting its online gambling licensing portal. In a press release on Monday, the CGA announced plans to implement a temporary replacement system starting Tuesday.
The breach was detected on September 17 when CGA investigators concluded that a German security researcher had gained unauthorized access to the authority's licensing portal and its database. The intruder reportedly accessed and published personal and sensitive information of license holders, with the unauthorized access believed to have occurred between December 2025 and September 2026.
According to the CGA, the compromised portal and database were managed by an external provider. Following the discovery of the breach, the authority swiftly took the portal offline to conduct a thorough investigation.
As a response to the incident, the CGA has made the decision to discontinue the use of the current portal and permanently terminate the provider's regulatory services. On October 19, the CGA plans to unveil a well-tested temporary portal to facilitate ongoing licensing and supervisory activities while preparing to create and manage a new internal system.
In anticipation of the temporary system's launch, the CGA identified components needing further work or security evaluations, including the internal system, digital seal, and license register—all of which are ready for independent security audits. Adjustments to the client portal are also underway before its security evaluation.
The CGA has clarified that closing the old portal will not invalidate existing licenses, which means licensed companies must continue to adhere to their regulatory responsibilities.
To mitigate the impact of the stolen data, the CGA has reported the incident and filed formal complaints in Curaçao, Germany, and the Netherlands. It has also engaged specialists to remove any compromised material from online sources. An independent forensic investigation is currently being conducted to assess the breach's scope and determine necessary remedial actions. Furthermore, the CGA is exploring the possibility of civil litigation.
This breach occurs at a time when Curaçao is modernizing its licensing and supervisory processes for online gambling. The Ministry of Finance had directed the former Gaming Control Board, now the CGA, to undertake reforms in the sector to address international scrutiny related to the former master license/sublicense model, an increase in player complaints, negative media attention, and obligations established through agreements with the Netherlands.
The new LOK gambling law, effective December 2024, replaced the previous licensing framework, granting the CGA direct supervisory authority over operators. As part of these reforms, the CGA has engaged outside technology and regulatory experts, launching an externally managed licensing portal in 2024 to facilitate applications and oversight while developing its internal capabilities. Since commencing these reforms, the CGA claims to have recruited 14 staff members who specialize in licensing, supervision, and enforcement, as part of their strategy to lessen reliance on external advisors.
