Curaçao Regulator Details Portal Breach and Plans Replacement System

The Curaçao Gaming Authority has published a detailed account of the breach affecting its online gambling licensing portal, outlining legal action, data-removal efforts and plans to replace the externally managed system.

In a statement published on October 19, CGA said it discovered on September 17 that a German cybersecurity researcher had accessed the portal without authorisation. Its investigations indicated that access continued between December 2025 and September 2026.

The regulator said confidential information belonging to online gambling licence holders was obtained and published. It characterised the conduct as criminal and said it had commissioned an independent technical investigation into the attack’s impact and consequences. 

Complaints Filed in Three Jurisdictions

CGA said it had filed complaints and reported the incident to authorities in Curaçao, Germany and the Netherlands.

It also engaged specialist companies to seek removal of the exposed information from the internet and is considering civil legal action.

The statement identifies the affected infrastructure as the licensing portal and its database, both managed by an external company. It does not name that provider.

The document sets out CGA’s account of the incident and response. It does not present the completed findings of the independent technical investigation. 

Interim Portal Launch Remains Unconfirmed

CGA permanently abandoned the previous portal and its associated service arrangements on October 7, following an initial investigation, security measures and the system’s removal from service.

Its replacement statement scheduled an interim portal for October 19, alongside a licence register and digital seal intended to demonstrate that a website holds a CGA licence.

However, the same document described work still outstanding. The internal system, register and seal were ready for independent security checks, while the client-facing portal required adjustments before testing.

As of October 20, CGA’s homepage continued to display the planned October 19 launch date. That notice did not confirm that the replacement had entered service. 

CGA is also preparing to develop and manage a permanent portal.

Outsourcing Followed Accelerated Regulatory Reform

The regulator used the statement to explain why it initially relied on external technology and expertise.

According to CGA, the finance ministry decided in the second half of 2023 to begin reforming online gambling oversight before the new National Ordinance on Games of Chance, known as LOK, entered into force in December 2024.

The authority cited agreements with the Netherlands, increasing player complaints, negative media coverage and preparations for Curaçao’s June 2024 Caribbean Financial Action Task Force assessment.

Because the reform required specialist knowledge, CGA brought in outside parties with experience in technology, licensing and supervision. It said the externally managed portal was intended to be replaced by an internally managed system over time.

Since 2024, CGA has recruited 14 employees, primarily in licensing, supervision and enforcement, as part of efforts to build local expertise and reduce reliance on advisers. It stressed that responsibility for licensing and oversight remained with the authority throughout. 

The portal’s closure does not invalidate existing licences. Operators remain responsible for meeting their obligations while licensing and supervisory work continues through alternative arrangements.