Curaçao Gaming Authority to replace its licensing portal after data breach exposed licensee information

The Curaçao Gaming Authority (CGA) is standing up a temporary licensing portal after a security breach exposed confidential information belonging to online gaming license holders. For operators and PSPs, the immediate point is simple: the regulator says existing licences remain valid, and regulatory duties continue while the new setup is brought online.

1. The CGA said on Monday, 19 October that it will launch a temporary portal on Tuesday and permanently retire the compromised system. The move comes one month after the authority detected the incident and marks a break from the technology setup it adopted in 2024, when it outsourced the portal while strengthening its internal structure.
2. According to the regulator, the breach was detected on 17 September, when investigators concluded that a security researcher based in Germany had accessed the licensing portal and its database without authorisation. The CGA says that person viewed and published personal and confidential information belonging to licence holders.
3. The unauthorised access is said to have continued for an extended period, between December 2025 and September 2026. The portal and the database supporting it were run by an external provider, and the CGA disconnected the platform after the issue was identified.
4. The authority has now permanently terminated the external provider’s regulatory services and is moving in two directions at once: a temporary portal under testing, and a new in-house case management system. The internal system, the digital seal, and the licence register are ready for independent security audits, while the client portal still needs further work before its security testing.
5. Existing licences are not voided by the shutdown of the old portal. The CGA said licensed companies must keep meeting their regulatory obligations during the transition, and the temporary portal is meant to prevent any interruption in licensing and supervision. To contain the spread of the stolen data, the authority has filed formal complaints in Curaçao, Germany, and the Netherlands, hired specialist firms to remove the material from the internet, and launched an independent forensic investigation. It has also said it does not rule out civil action.

The broader regulatory overhaul is still being built, which is the part high-risk operators will watch most closely: not the breach itself, but how quickly the CGA can restore a working portal without turning licensing administration into a bottleneck.