Curaçao Gaming Authority to launch temporary licensing portal after data breach exposed licence-holder data

The Curaçao Gaming Authority (CGA) is replacing its online licensing portal after a breach exposed confidential information belonging to licence holders. For high-risk operators and their PSPs, the immediate issue is not just the leak itself, but whether licensing workflows, supervisory checks, and document handling can keep moving while the regulator rebuilds its system.

1. The breach was discovered on 17 September, when CGA investigators found that a security researcher from Germany had gained unauthorised access to the authority’s licensing portal and its database. The CGA said personal and confidential information belonging to licence holders had been accessed and published.
2. According to the regulator, the unauthorised access took place between December 2025 and September 2026. The affected portal and its supporting database were managed by an external provider, and the CGA took the portal offline for investigation after identifying the incident.
3. In a press release issued on Monday, the CGA said it plans to launch a temporary replacement portal on 19 October so licensing work and supervisory tasks can continue. It is also preparing to develop and operate a new internally managed system, and said the old portal will no longer be used.
4. The authority said several components still need further work or security testing before the temporary system goes live, including the internal system, digital seal and licence register. Those parts are already ready for independent security checks, while adjustments are being made to the client portal ahead of testing.
5. The CGA said closing the old portal does not invalidate existing licences, and licensed companies remain subject to their regulatory obligations. It has reported the intrusion and filed formal complaints in Curaçao, Germany and the Netherlands, engaged specialist companies to remove material that has appeared online, and is considering civil litigation.

The incident lands at a sensitive moment for Curaçao, which has been reworking how it licences and supervises online gambling. In 2023, the Ministry of Finance instructed the then Gaming Control Board, now the CGA, to reform oversight after criticism of the island’s former master licence/sublicence model, a rise in player complaints, adverse media coverage and commitments under agreements with the Netherlands. The new LOK gambling law came into force in December 2024.