After a significant data breach, the Curaçao Gaming Authority (CGA) is now replacing its online gambling licensing portal. The leak in question exposed confidential information about its Curaçao licensed gambling brands.
According to the regulator, the incident was discovered on September 17, 2026, after a German digital security researcher had gained unauthorised access to the portal in December 2025. The hacker accessed and published data from the system, which was managed by an external provider.
Investigations suggest that the unauthorised access continued took place between December 2025 and September 2026, with the leak affecing both the licensing portal and its database.
The authority described the incident as a serious matter for the regulator, the gambling sector and its licencees whose information was compromised.
CGA Reports Breach to Authorities
After the discovery, the CGA was quick to launch an internal investigation and strengthened its security measures. Afterwards, it took the portal offline for an external technical investigation.
The regulator also filed complaints and reported the incident to local authorities of Curaçao, Germany and the Netherlands. It confirmed it hired specialist companies to remove the exposed information from the internet and commissioned an independent investigation to assess the leak’s overall impact.
The CGA is also looking into taking civil legal action and remains in contact with industry stakeholders. It added that its response aims to limit the damage, protect affected licence holders and maintain confidence in Curaçao's gambling regulatory framework.
On October 7, 2026, the authority announced that it would permanently discontinue the existing licensing portal and end its use of the provider's regulatory services.
In the meantime, the regulator launched on a temporary make-shift portal to allow licensing applications and other supervisory work to continue. CGA is also planning to develop a new system that it will manage internally.
The temporary platform requires security testing, vulnerability checks, and assessments to ensure it works properly for both operators and CGA. According to the Authority, its internal system, digital seal and licence register were ready for independent security checks, while adjustments to the client portal were still underway.
The temporary portal was introduced on October 19, 2026. The licence register and digital seal system were also expected to become available alongside it.
The CGA assured that closing the previous portal does not invalidate existing licences. Licensed companies must continue to fulfil their regulatory obligations, as the portal is only a tool supporting licensing and supervision.
External Provider Selected During Regulatory Reform
The data breach happened at a time when Curaçao is undergoing broader gambling regulatory reform, which began in 2023 under instructions from the Minister of Finance. The reform aimed to improve Curaçao’s international reputation following criticism of online gambling companies operating from the island.
Other factors included agreements with the Netherlands under the Country Package, an increase in player complaints, negative media coverage and Curaçao's upcoming assessment by the Caribbean Financial Action Task Force from June 2024.
The Ministry of Finance decided to start the said reform in the second half of 2023 and not wait for the National Ordinance on Games of Chance, which entered into force in December 2024.
Considering the scope of the initiative and the need for expert advice, CGA initially relied on external providers for technology, licensing and supervision. An externally managed portal was selected to handle licence applications and approvals, with dedicated CGA employees supporting its operations.
The regulator intended to move to an internally managed portal at a later stage. Since the reform began in 2024, it has hired 14 employees, mainly for licensing, supervision and enforcement, to work with local expertise and gradually reduce reliance on external advisers.
Still, the CGA stressed that, despite the involvement of external providers, responsibility for licensing and supervision remained with the authority.
Attempting to Rebuild Trust
Curaçao’s National Ordinance on Games of Chance (LOK) introduced a system in which the Authority directly supervises online gambling operators, which replaced the previous framework of master licences and sublicences.
The objective behind the reform is to improve oversight, provide greater clarity and strengthen the island's reputation as a gambling licensing jurisdiction. According to the regulator, these objectives are important for player protection, public revenue and local businesses providing services to the sector.
CGA acknowledged that the breach could undermine confidence in its operations and said it must use the investigation's findings to improve its security and working methods.
It also stressed the importance of addressing the concerns of those affected, sharing accurate information and maintaining dialogue between the regulator, operators, service providers and government.
As more regulatory information is handled digitally, the authority said organisations must continue to pay attention to cybersecurity risks. However, it stressed that the gravity of the incident should not be underestimated, given that data breaches affect organisations worldwide.
Finally, CGA said rebuilding trust would depend on effective supervision, professional services, accurate information and clear decisions affecting the sector.
With the regulator approaching its second anniversary and the LOK nearing its second anniversary on 24 December, the authority called on industry stakeholders to continue working together to develop a sustainable online gambling sector that benefits Curaçao.
