Cyberattack Forces Curaçao Gaming Authority to Launch Temporary Licensing Portal on October 19, 2026

The Curaçao Gaming Authority (CGA) will replace its compromised licensing platform with a temporary portal after a cyberattack exposed more than 40,000 documents tied to the island’s gambling sector. For operators, the immediate point is simple: licensing and supervision will continue, but on a different system, under tighter scrutiny, and after an external investigation.

1. The CGA said the temporary portal will go live on October 19, 2026 and will handle license applications and other regulatory tasks while the authority develops a long-term proprietary platform. The regulator will not restore the compromised platform.
2. According to the CGA, the breach began in December 2025 and continued until September 2026. Berlin-based cybersecurity researcher Lilith Wittmann claimed responsibility for the intrusion, and the data reportedly accessed and published includes ownership declarations, license applications, regulatory assessments, and tax documents.
3. The regulator said the incident affected most licensed operators and may have exposed sensitive information. It has notified authorities in Curaçao, Germany, and the Netherlands, and it is now focused on protecting confidential data and limiting the use and spread of the leaked materials.
4. Curaçao authorities said existing gambling licenses remain valid. The temporary portal will undergo robust security checks before launch, while the client portal was still under development and the internal system, digital seal, and license register were ready for independent testing.
5. The CGA linked the breach to the broader transition triggered by Curaçao’s 2023 gambling overhaul and the National Ordinance on Games of Chance (LOK), which replaced the old licensing system. The regulator said the reforms were meant to improve oversight, introduce safety mechanisms, and address international criticism, but the shift also exposed weaknesses during the handover from external specialists to local control.

For PSPs and operators active in Curaçao, the practical question is not whether the licensing framework still exists; it does. The question is how much operational friction, document exposure, and security review will now sit around every application, amendment, and supervisory interaction while the new portal is built.