The Curaçao Gaming Authority (CGA) is replacing its online gambling licensing portal following a data breach involving personal documents and confidential information submitted by licence holders.
The regulator said it discovered the breach on 17 September. According to its investigations, unauthorised access occurred between December 2025 and September 2026, affecting a portal and database managed by an external company.
CGA alleges that a Germany-based digital security researcher accessed the system without permission and published information obtained from it. The regulator characterised the conduct as criminal, though its statement didn't report a court finding.
The authority has filed complaints and reported the incident to authorities in Curaçao, Germany and the Netherlands. It has also commissioned an independent technical investigation to establish the breach’s impact and engaged specialist companies to remove information available online.
Civil legal action remains under consideration.
After initially strengthening security and conducting an internal investigation, CGA took the portal offline. On 7 October, it announced that the platform wouldn't reopen and that it would discontinue the provider’s regulatory services.
A temporary replacement was scheduled to launch on 19 October, alongside the licence register and digital seal system.
Preparations included independent security testing, vulnerability checks and assessments of usability for applicants and staff.
CGA also plans to develop a new portal under its own management.
The regulator said closing the previous platform does not invalidate existing licences, and licensees must continue meeting their obligations.
The breach comes amid wider scrutiny of Curaçao’s online gambling sector. Norwegian broadcaster NRK used leaked licensing documents in an investigation identifying 782 casino websites with Norwegian-language adaptations, prompting enforcement concerns in Norway.
Separately, financial forensic researcher Luigi Faneyte has called for an independent investigation into financial flows and procurement arrangements connected with the sector.
The CGA’s digital seal is intended to identify websites holding its licence; the seal system and licence register were scheduled to return alongside the temporary portal
