The Curaçao Gaming Authority (CGA) is responding to a significant data breach that has affected its online gambling licensing portal. In a press release dated Monday, the CGA announced plans to launch a temporary replacement of the licensing system following the breach, which was detected on September 17.
Investigators from the CGA learned that a security researcher from Germany had unlawfully accessed the licensing portal and its associated database. This unauthorized intrusion reportedly took place between December 2025 and September 2026, allowing the intruder to access and publish personal and confidential information about various licence holders.
The affected portal and its database were managed by an external provider, which has since been terminated as a result of the breach. In light of these findings, the CGA took the problematic portal offline to conduct a thorough investigation.
As part of its recovery plan, the CGA has decided to cease using the existing portal permanently. A carefully tested temporary portal is set to launch on October 19, aimed at enabling the continuation of licensing work and regulatory tasks. Efforts are also underway to create and operate a new internally managed system.
Before the temporary system goes live, the CGA has identified several components requiring additional work and security testing. Key elements, such as the internal system, digital seal, and licence register, are prepared for independent security assessments, while adjustments to the client portal are being finalized.
The authority clarified that the closure of the old portal does not affect the validity of existing licences, and licensed entities are still obligated to meet their regulatory requirements.
To mitigate further risk, the CGA has filed reports on the intrusion and formal complaints in Curaçao, Germany, and the Netherlands. They have enlisted the help of specialized companies to eliminate any online material related to the breach. An independent forensic investigation is ongoing to determine the full impact of the breach and inform necessary remedial actions. The CGA is also contemplating civil litigation in response to the incident.
This breach occurs amidst ongoing reforms to how Curaçao regulates and oversees online gambling. In 2023, the Ministry of Finance directed the then Gaming Control Board—now the CGA—to overhaul the sector's oversight, fueled by rising player complaints, negative media reports, and obligations set by agreements with the Netherlands. The new LOK gambling law, effective December 2024, replaced the previous licensing structure and placed the CGA in direct control of operator supervision.
As part of these changes, the CGA has recruited 14 specialists in licensing, supervision, and enforcement since the reforms began, with the aim of reducing dependency on external advisors.
