Curaçao Gaming Authority set to launch temporary licensing portal after data breach
The Curaçao Gaming Authority (CGA) has moved to contain a serious data breach affecting its online gambling licensing portal.
In a press release issued on Monday, the CGA said it planned to launch a temporary replacement of the system on Tuesday in response to the breach.
The breach was discovered on 17 September when CGA investigators determined that a security researcher from Germany had gained unauthorised access to the authority’s licensing portal and its database.
According to the CGA, the intruder had accessed and published personal and confidential information belonging to licence holders. The unauthorised access is said to have occurred between December 2025 and September 2026.
The CGA said the affected portal and its supporting database were managed by an external provider.
The authority took the affected portal offline for investigation after uncovering the breach.
Change of portal and temporary solution
Following the breach and subsequent investigations, the CGA has decided to stop using the existing portal and terminate the provider’s regulatory services permanently.
The authority said it will launch a carefully tested temporary portal on 19 October to allow licensing work and supervisory tasks to continue, and is preparing to develop and operate a new internally managed system.
The CGA identified several components requiring further work or security testing before the temporary system goes live.
These included the internal system, digital seal and licence register, which the CGA said are ready for independent security checks.
Adjustments are being made to the client portal ahead of security testing.
The CGA emphasised that closing the old portal does not invalidate existing licences, with licensed companies remaining subject to their regulatory obligations.
Notifications, takedown efforts and investigations
In an effort to limit the spread and use of stolen data, CGA said it has reported the intrusion and filed formal complaints in Curaçao, Germany and the Netherlands.
It has also engaged specialist companies to remove material that has appeared online.
An independent forensic investigation is under way to establish the extent of the breach and inform remedial steps.
Additionally, the CGA is considering civil litigation.
Regulatory context
The incident comes with Curaçao continuing to rework how it licences and supervises online gambling.
In 2023 the Ministry of Finance instructed the then Gaming Control Board (now CGA) to reform the sector’s oversight, a move driven by international criticism of the island’s previous master licence/sublicence model, a rise in player complaints, adverse media coverage and commitments under agreements with the Netherlands.
The new LOK gambling law, which came into force in December 2024, replaced the old licensing architecture and put the CGA in direct supervisory control of operators.
As part of that reform, the CGA brought in outside technology and regulatory experts and launched an externally managed licensing portal in 2024 to handle applications and supervision while it built internal capacity.
Since the reform began, CGA says it has hired 14 staff specialising in licensing, supervision and enforcement with the intention of reducing reliance on external advisers.