Curaçao regulator hires specialist firms to remove stolen data and orders an independent breach investigation

The Curaçao regulator has brought in specialist companies to delete information that was stolen from it and has commissioned an independent investigation into the breach. For PSPs, acquirers, and high-risk operators, the point is straightforward: when a licensing authority is dealing with a data incident, the operational and compliance follow-through matters as much as the leak itself.

1. The regulator said it engaged specialist firms to remove the stolen information from circulation. That is the practical containment step: once data is out, the job becomes part cleanup, part monitoring, part damage control.
2. An independent investigation has also been ordered. In regulated verticals, that usually means the authority wants a separate read on what was taken, how the breach happened, and what the consequences are for its own systems and processes.
3. The source does not give further details on the scope of the leak, the identity of the attackers, or the timing of the incident. So at this stage, the only confirmed facts are the remediation effort and the outside review.