Curaçao Gambling Authority shuts down online licensing portal after hack exposed over 40,000 documents

The Curaçao Gambling Authority (CGA) is closing its online licensing portal after a hacking incident that led to more than 40,000 documents being publicly released. For operators and PSPs touching Curaçao-licensed business, the practical point is simple: the regulator says licenses remain valid, but the portal that handled part of the licensing workflow is going away.

1. The CGA said in an official press release last week that it is discontinuing the portal and the related service arrangements that supported it. In other words, this is not just a website being taken offline; the operating setup behind it is also being phased out while the regulator says it will keep its core functions running.
2. The decision follows a breach of the CGA’s online gaming portal that the regulator reported on September 17, 2026. At that point, the CGA said it had detected unauthorized access, contained the incident, identified its source, and activated incident response procedures together with its service provider, which then began a forensic investigation.
3. A few days later, Berlin-based cybersecurity researcher Lilith Wittmann claimed responsibility for the hack. According to the text, the leak exposed ownership declarations, license applications, regulatory assessments, tax documents, and other records, including details about companies whose ownership is often difficult to verify through public corporate registers.
4. The CGA said it remains committed to safeguarding the integrity of its regulatory functions and information assets, and that the transition may create challenges for operators. It also thanked them for their cooperation and understanding while the change is implemented.
5. For existing license holders, the key operational detail is that the portal shutdown does not affect the validity of current licenses, the obligations of licensed operators, or the CGA’s ongoing supervisory work. The regulator said licensing, compliance, and supervision will continue under alternative arrangements while an interim solution is being put in place, but as of October 12 it had not disclosed that solution.

The deadline the CGA had indicated for further details was no later than October 9, 2026. As of the article date, the regulator had still not published information on the interim setup, which leaves operators and their payment partners waiting for the mechanics of how Curaçao-facing compliance and licensing work will now be handled.