• Home
• Curaçao Gaming Authority Discontinues Portal After Breach

Curaçao Gaming Authority Discontinues Portal After Breach

Curaçao Gaming Authority Discontinues Licensing Portal – Data Breach Prompts Shift to Internal Regulatory Systems

Key Takeaways

• The CGA permanently closed its licensing portal after a data breach exposed confidential operator information between December 2025 and September 2026.
• A temporary replacement system goes live on October 19 to ensure existing gambling licenses remain operational and compliant.
• The regulator terminated its external technology provider and is preparing to deploy an entirely internally managed digital infrastructure.
• Authorities filed formal complaints in Curaçao, Germany, and the Netherlands to pursue legal action over the unauthorized access.

Unauthorized Access Exposes Confidential Operator Data

The Curaçao Gaming Authority identified a severe security incident involving its main regulatory platform. Investigators discovered that a German security researcher bypassed security protocols to access the portal and its underlying database. This unauthorized entry allowed the individual to view personal and confidential information belonging to gambling license holders and subsequently publish the extracted files.
The security breach went undetected for several months. Official reports indicate the unauthorized access occurred between December 2025 and September 2026. Authorities formally uncovered the intrusion on September 17, triggering an immediate intervention to secure the compromised infrastructure.
The affected system was operated and managed entirely by an external technology provider. The CGA took the portal offline right after the discovery to prevent further data exposure. An independent forensic examination is currently active to determine the exact scope of the compromised data and to formulate the required technical remedies.

Legal Action and Data Removal Efforts Underway

The regulatory body initiated a multi-jurisdictional legal response to the data theft. The CGA filed formal legal complaints in Curaçao, Germany, and the Netherlands to address the unauthorized intrusion. The authority is currently evaluating options for civil litigation against the parties responsible for accessing and distributing the confidential documents.
Immediate steps were taken to mitigate the public exposure of sensitive operator details. The regulator hired specialized cybersecurity and data removal companies to track down and eliminate the stolen information published on the internet. These teams work to scrub the exposed documents from public servers and limit further distribution.
The termination of the external provider marks a definitive end to their involvement in Curaçao’s regulatory services. The CGA explicitly stated that the external regulatory specialists previously engaged to support application processing and supervisory activities will no longer participate in the licensing framework.

Temporary Portal Maintains Ongoing Regulatory Operations

The sudden shutdown of the main regulatory platform required an interim solution to maintain industry oversight. The CGA announced the launch of a temporary replacement portal on October 19. This interim system ensures that operators can continue to interact with the regulator while a permanent infrastructure is finalized.
Regulators made it clear that the platform closure does not affect the legal status of current gambling operators. Existing licenses remain fully active and valid across the jurisdiction. Operators are still required to meet all regulatory and compliance obligations under the active framework, regardless of the portal transition.
Work on a fully internal replacement system is already in the advanced stages. The new digital seal, license register, and core internal systems were identified as ready for independent security assessments. Adjustments to the client-facing portal are nearing completion before the final testing phase begins.

Incident Accelerates Transition to Direct Regulatory Supervision

This security incident occurred against the backdrop of massive regulatory shifts within the jurisdiction. Curaçao implemented the National Ordinance on Games of Chance (LOK) in December 2024. This new legal framework eliminated the decades-old master license and sublicense model, replacing it with direct supervision by the CGA.
The compromised portal was originally deployed in 2024 as a bridge solution during these widespread reforms. External technology specialists were brought in to handle the immediate influx of licensing applications while the authority built its own internal capacity. The Ministry of Finance originally mandated this regulatory overhaul in 2023 to address international criticism of the previous licensing structure, a rising volume of player complaints, adverse media coverage, and binding commitments made under agreements with the Netherlands.
The CGA is now expanding its own operational workforce to handle the workload independently. The regulator successfully recruited 14 new employees who specialize directly in licensing, supervision, and enforcement. This expanded team forms the core of the authority’s strategy to eliminate reliance on external advisers and manage all regulatory matters internally moving forward.

Our Assessment

The data breach at the Curaçao Gaming Authority forces a sudden structural change in how the jurisdiction processes and secures gambling operator data. Terminating the external provider and launching an internally managed system aligns with the broader goals of the LOK legislation enacted in 2024. Moving oversight entirely in-house with a newly expanded team of 14 specialists shifts the regulatory burden directly onto the CGA. While existing licenses remain unaffected, the multi-national legal complaints and ongoing forensic investigations indicate that securing operator data will dominate the operational focus for the regulator in the immediate future.