Curaçao Gaming Authority Retires Licensing Portal – Regulator Internalizes Services Following Security Breach
Curaçao Gaming Authority Retires Licensing Portal – Regulator Internalizes Services Following Security Breach
Key Takeaways
- The Curaçao Gaming Authority permanently shut down its externally managed licensing portal following a significant data breach.
- An unauthorized party accessed the database between December 2025 and September 2026, exposing confidential operator information.
- The regulator terminated its contract with the external provider and is transitioning all digital services to an internal system.
- Existing gambling licenses remain valid and operator compliance obligations are completely unaffected by the system outage.
Regulator Abandons External Portal After Unauthorized Access
The Curaçao Gaming Authority has permanently retired its online licensing portal following a severe security incident. The regulator ended its reliance on the external provider that previously supplied these regulatory services. The decision came after a breach exposed personal and confidential information belonging to active gambling license holders.
According to the regulator, a German security researcher managed to access the externally managed portal and its associated database without authorization. This intrusion persisted over an extended period. The unauthorized access occurred between December 2025 and September 2026.
The gaming authority officially discovered the security breach on September 17. The regulator immediately took the platform offline to prevent any further unauthorized data access. The exact volume of exposed confidential data remains unspecified in the official statement.
Legal Responses Follow Information Exposure
The regulatory body is taking active steps to mitigate the fallout from the exposed operator data. The authority hired dedicated specialists to pursue the removal of any published information resulting from the breach. The goal is to protect the confidentiality of the affected gambling license holders as much as possible.
The regulator escalated the incident beyond internal mitigation efforts. The authority filed formal complaints across three separate jurisdictions in response to the unauthorized database access. The gaming authority is actively considering pursuing civil action alongside these official complaints.
Authority Shifts to Internal System for License Management
The gaming authority plans to manage its replacement licensing platform entirely within its own organization. The regulator explicitly cited a desire to reduce its ongoing reliance on outside service providers for essential regulatory infrastructure. The transition requires the deployment of both temporary and permanent digital solutions.
The authority scheduled a temporary portal to launch on October 19. This interim system is designed to support new license applications and ongoing regulatory supervision while the permanent infrastructure is prepared. The official statement described outstanding testing requirements but did not confirm if every replacement service actually became operational on that target date.
Several components of the permanent system are currently ready for independent security checks. These components include the internal system infrastructure, the official license register, and the digital seal functionality. A digital seal serves as a verification tool that allows a website to prominently display its active licensing status to users. The client portal portion of the new platform still required further adjustments before formal testing could begin.
Regulatory Overhaul Continues Uninterrupted
This security incident coincides with a broader structural transformation of the entire Curaçao gambling regulatory framework. The National Ordinance on Games of Chance, commonly known as LOK, officially took effect in December 2024. This sweeping legislation fundamentally altered how the jurisdiction governs international gambling operations.
The new legal framework replaced the legacy system of master licenses and sub-licenses with a model based on direct regulatory supervision. The gaming authority recruited 14 new employees dedicated strictly to licensing, supervision, and enforcement duties since these comprehensive reforms began. This expanded internal workforce aligns with the new strategy of internalizing technical and regulatory services.
The closure of the compromised licensing portal does not alter the legal standing of any active operators. The regulator explicitly stated that the portal shutdown does not invalidate any existing gambling licenses. All current compliance obligations remain in full effect, and operators must continue to adhere to the established regulatory standards while the authority finalizes its new internal reporting systems.
Our Assessment
The Curaçao Gaming Authority faces a significant technical disruption just as it works to solidify direct supervision over its licensees. The extended data breach exposed critical vulnerabilities in the externally managed portal, prompting a rapid and necessary shift toward entirely internal infrastructure. Moving these core systems in-house requires rigorous independent security testing to rebuild confidence among international operators. The ongoing legal validity of existing licenses ensures stability for the market, though the timeline for fully deploying the permanent client portal and associated services remains pending.
We have imposed strict editorial guidelines on ourselves and explain our testing methods openly and comprehensively. We also communicate transparently how our work is financed. This site may contain tracking links, but this does not influence our objective view in any way.
