The Curaçao Gaming Authority (CGA) is addressing a significant data breach that has impacted its online gambling licensing portal. In a statement released on Monday, the CGA announced plans to launch a temporary replacement for the compromised system starting Tuesday.
The breach was identified on September 17, when investigators determined that a German security researcher had gained unauthorized access to the licensing portal and its database. According to the CGA, this intruder accessed and publicly disclosed personal and confidential information belonging to license holders. Reports suggest that this unauthorized activity took place between December 2025 and September 2026.
The CGA stated that the affected portal and its database were being managed by an external provider. Following the detection of the breach, the authority took the portal offline to facilitate an investigation.
Given the circumstances, the CGA has opted to discontinue the use of the existing portal and terminate the provider’s regulatory services permanently. It announced that a meticulously tested temporary portal will be launched on October 19, allowing the continuation of licensing and supervisory tasks, while also preparing to create and manage a new internal system.
The CGA has recognized several components that require further enhancement or security testing before the temporary portal goes live. These include the internal system, digital seal, and license register, which the authority noted are ready for independent security evaluation. Adjustments to the client portal are also being made ahead of security testing.
The CGA reiterated that the shutdown of the old portal does not affect the validity of existing licenses, as licensed entities will remain bound by their regulatory responsibilities.
To mitigate the potential misuse of stolen data, the CGA has reported the breach and filed formal complaints in Curaçao, Germany, and the Netherlands. It has also enlisted specialized firms to remove any leaked information from online platforms. An independent forensic investigation is currently underway to assess the breadth of the breach and to formulate necessary remedial actions. Additionally, the CGA is contemplating civil litigation against the perpetrator.
This incident comes amid broader reforms in Curaçao's online gambling licensing and supervisory frameworks. In 2023, the Ministry of Finance mandated the then Gaming Control Board (now CGA) to enhance sector oversight due to international criticism of its former master license/sublicense system, a rise in player complaints, negative media coverage, and obligations under agreements with the Netherlands.
The new LOK gambling law, enacted in December 2024, overhauled the old licensing model and positioned the CGA to directly oversee operators. As part of this reform effort, the CGA has engaged technology and regulatory experts and launched an externally managed licensing portal in 2024 to streamline applications and oversight while it strengthens its internal capabilities. Since the reform process began, the CGA has recruited 14 staff members with expertise in licensing, supervision, and enforcement to diminish its dependence on external advisors.
