The Curaçao Gaming Authority (CGA) is taking action following a significant data breach that has impacted its online gambling licensing portal. In a press release issued on Monday, the CGA announced plans to roll out a temporary replacement for the compromised system on Tuesday.
The breach was identified on September 17, when CGA investigators discovered that a German security researcher had gained unauthorized access to both the licensing portal and its database. The CGA reported that the intruder had accessed personal and confidential information of license holders, and this unauthorized access is believed to have occurred between December 2025 and September 2026.
The affected portal and database were managed by an external provider. In response to the breach, the authority took the portal offline to conduct an investigation.
In light of the breach and ongoing investigations, the CGA has decided to discontinue the old portal permanently and terminate the services of the provider responsible for managing it. A temporary portal is set to launch on October 19, intended to facilitate licensing and supervisory tasks while the authority develops a new system managed internally.
The CGA has identified certain components that require further security testing before the temporary portal goes live. This includes the internal system, digital seal, and license register, all of which are ready for independent security assessments. Changes are currently being made to the client portal in preparation for the testing phase.
The CGA has stated that despite closing the old portal, existing licenses remain valid, obligating licensed companies to adhere to their regulatory responsibilities.
To mitigate the impact of the data breach, the CGA has filed reports about the intrusion with authorities in Curaçao, Germany, and the Netherlands. Additionally, they are working with specialist firms to have any online material linked to the stolen data removed and have initiated an independent forensic investigation to determine the breach's extent and guide remedial actions. Civil litigation is also under consideration.
This incident occurs amid ongoing reform of the licensing and oversight process for online gambling in Curaçao. In 2023, the Ministry of Finance directed the then Gaming Control Board, now known as the CGA, to enhance oversight in response to international criticism of the previous master license/sublicense model, a surge in player complaints, negative media coverage, and agreements with the Netherlands. The new LOK gambling law, which took effect in December 2024, replaced the previous licensing framework, placing the CGA in direct control of supervising operators.
As part of these reforms, the CGA has hired outside technology and regulatory experts and introduced an externally managed licensing portal in 2024 to handle applications and oversight while building its internal capabilities. Since the initiation of this reform process, the CGA has brought on 14 staff members specializing in licensing, supervision, and enforcement to reduce the reliance on external advisors.
