Curaçao shuts down its gaming portal after a leak of more than 40,000 documents

The Curaçao Gaming Authority (CGA) has confirmed that its old online gaming portal will not return and that the regulator is moving to a new platform. For PSPs, acquirers, and banks, the practical issue is not the website itself; it is the workflow behind it: licensing, supplier applications, periodic and incident reporting, and change notifications all ran through that portal.

1. The breach timeline is unusually long. According to the CGA, access to the portal was obtained in December 2025 using a fake identity, and the incident was discovered on 17 September 2026. The investigation is still ongoing.
2. More than 40,000 documents were exposed. The regulator said the leak involved confidential data and that it is taking additional security measures and intends to contact the relevant authorities.
3. Existing licenses remain valid. The CGA confirmed that shutting down the portal does not affect the validity of current licenses and does not remove licensee obligations.
4. New applications are now in limbo. The regulator says it will continue licensing and supervision through alternative procedures while the new platform is being prepared, but no published process was available at the time of writing.
5. License checks through the website may become less reliable. The CGA is preparing an alternative to the current digital seal, so the old method of confirming a license on the site may stop working. For PSPs, the point is obvious: verify status directly with the regulator, not by a badge on an operator’s homepage.

For high-risk payments teams, the immediate effect is timing and uncertainty. New operators may reach market later, changes to existing operator data may take longer, and banks or acquirers may ask for extra proof around UBO and license status while the new Curaçao process settles down.