Curaçao Gaming Authority Launches Temporary Portal After Data Breach

The Curaçao Gaming Authority (CGA) has launched a temporary licensing portal following a data breach that exposed confidential information of license holders. The breach, discovered on September 17, involved unauthorized access to the authority’s previous externally managed system.

What Happened

The Curaçao Gaming Authority (CGA) announced on Monday, October 18, 2026, its plan to launch a temporary replacement for its online gambling licensing portal following a significant data breach. The breach, identified on September 17, revealed that a security researcher from Germany had gained unauthorized access to the CGA’s licensing portal and its associated database, as reported by iGaming Business.

Investigators determined that the unauthorized access, which reportedly occurred between December 2025 and September 2026, led to the publication of personal and confidential information belonging to license holders. The affected portal and its supporting database were managed by an external provider, which the CGA subsequently took offline for investigation after discovering the breach, according to Gaming Compliance News.

Key Details

• The data breach was discovered on September 17, 2026, with unauthorized access occurring between December 2025 and September 2026, according to the CGA.
• A German security researcher reportedly gained unauthorized access to the CGA’s licensing portal and database, publishing confidential license holder information (iGaming Business).
• The CGA ceased using the affected externally managed portal and terminated its provider’s regulatory services permanently following the incident (Gaming Compliance News).
• A temporary, carefully tested portal was launched on October 19, 2026, to ensure continuity of licensing and supervisory tasks (Curaçao Gaming Authority press release).
• Formal complaints regarding the intrusion have been filed in Curaçao, Germany, and the Netherlands, and specialist companies have been engaged to remove leaked material (iGaming Business).

Why It Matters

This incident occurs amidst ongoing reforms to Curaçao’s online gambling licensing and supervision framework. In 2023, the Ministry of Finance instructed the then Gaming Control Board, now the CGA, to overhaul the sector’s oversight. This reform was driven by international criticism of the previous master license/sublicense model, an increase in player complaints, adverse media coverage, and commitments made under agreements with the Netherlands, as reported by iGaming Business.

The new LOK gambling law, effective December 2024, replaced the former licensing structure, placing the CGA in direct supervisory control of operators. As part of this transition, the CGA engaged external technology and regulatory experts and introduced an externally managed licensing portal in 2024 to manage applications and supervision while it developed internal capabilities. The CGA has since hired 14 staff specializing in licensing, supervision, and enforcement, aiming to reduce reliance on external advisors.

What’s Next

The CGA is preparing to develop and operate a new internally managed system to replace the temporary solution. Before the temporary system went live, several components, including the internal system, digital seal, and license register, were identified for further work or security testing. Adjustments are also being made to the client portal ahead of its security testing. An independent forensic investigation is underway to determine the full extent of the breach and guide remedial actions, with the CGA also considering civil litigation, according to iGaming Business.