Curaçao Gaming Authority closes its portal after data breach
CGA will issue an alternative domain proof while licences remain valid
Key Takeaways
- The Curaçao Gaming Authority closed its portal on 7 October and will not restore the compromised portal following the "Casino Secrets" breach.
- The CGA maintains the validity of existing licences and says regulatory and supervisory functions will continue via alternative arrangements.
- White-hat hacker Lilith Wittmann reported that extensive access to the CGA's database and systems was obtained.
- Availability of the current digital seal will be affected; the CGA will introduce an alternative mechanism for operators to prove domain licencing.
The Curaçao Gaming Authority announced on 7 October that it has closed its online portal after last month's hack, known as the "Casino Secrets" breach. The regulator has decided not to restore the compromised portal and is migrating licensing and supervisory activities to a new platform while maintaining the validity of existing licences.
What the Curaçao Gaming Authority did after the portal hack
The Curaçao Gaming Authority (CGA) decision was communicated in an official statement issued on 7 October. The regulator said it will not reinstate the portal affected by unauthorized access and will implement an alternative platform to continue licence processing, compliance and supervision. The portal closure follows a breach that exposed sensitive documents and ownership data of several gambling companies licensed under Curaçao gaming law. For regulatory context see [regulation](/regulation).
"The discontinuation of the portal does not affect the validity of existing licences, the obligations of licensed operators, or the CGA's supervisory and regulatory responsibilities." — Curaçao Gaming Authority
The authority stated that licensing, compliance and supervisory activities will continue via alternative arrangements while an interim solution is introduced. No specific launch date for the new platform was given.
Details and technical scope of the "Casino Secrets" breach
Public reports on the incident indicate that the intrusion — referred to in media and by participants as the "Casino Secrets" breach — enabled extensive access to the authority's database and systems. The leak included confidential documents and ownership details of several entities operating under licences issued pursuant to Curaçao gaming law.
The researcher who publicly warned of the hack, identified in reports as white-hat hacker Lilith Wittmann, stated that broad access to CGA records and systems was obtained.
Regulatory and operational consequences for licences in Curaçao
The CGA emphasised that the portal suspension does not invalidate licences nor absolve operators of their obligations. The body explicitly declared that its regulatory and supervisory responsibilities continue, and that control and verification tasks will be managed by alternative means until the new platform is in service.
The authority also warned that availability of the current digital seal will be affected by the portal shutdown. In response, the CGA announced that it will "shortly" introduce an alternative mechanism by which operators can demonstrate that a domain is licensed by the CGA. The official text did not detail the technical nature of that mechanism or a deployment timeline.
Containment measures and communication with operators
The CGA statement specifies that its post-incident efforts focus on containing the data leak and protecting the integrity of its regulatory functions and information. The authority acknowledged that the transition to alternative systems may create operational challenges for operators and thanked them for "their cooperation and understanding during this period."
While the interim solution is prepared, the CGA will handle licensing and supervisory processes through channels other than the affected portal. The regulator has not published formal technical instructions for operators on how to submit documentation or prove licence status during the interim phase; official communication is limited for now to assuring continuity via alternative arrangements.
Immediate risks and outstanding questions for operators and suppliers
For operators licensed under Curaçao gaming law the principal certainty is that their licences remain valid. Outstanding questions include:
how ownership and domain status will be verified in the absence of the digital seal,
what additional identity or ownership checks the CGA will require during the transition,
what impact the incident will have on processing times for new licences or renewals.
Technical and compliance service providers that integrate digital seals or verification widgets on gambling sites must prepare technical alternatives or support agreements while the CGA deploys its substitute mechanism. For firms that rely on the digital seal as public proof of licence, the practical recommendation is to document communications with the CGA and be ready for changes in the validation workflow. See relevant [b2b](/b2b) guidance where applicable.
What operators should prepare now
Licensed operators should:
Retain copies of all licence documentation and communications with the CGA.
Prepare alternative verification channels that can demonstrate the relationship with the regulator during the transition period.
Keep active communication with their domain and compliance providers to coordinate any proof-of-status the CGA may require.
The authority has not announced sanctions or regulatory changes linked to the incident; public communication has focused on regulatory continuity and containment of unauthorized access.
Outlook and next steps
The CGA has chosen not to restore the compromised portal and to migrate to a new platform with no announced launch date. The regulator will implement an interim solution to verify domains while the migration is completed. The operator and supplier community in Curaçao should follow official CGA communications for instructions on the alternative mechanism and temporary supervisory processes. For updates see [news](/news).
"Given that availability of the current digital seal will be affected, the CGA will shortly introduce an alternative mechanism by which operators can demonstrate that a domain is licensed by the CGA." — Curaçao Gaming Authority
The situation is evolving; the only certainty communicated so far is the continued validity of licences and the regulator's intent to maintain supervisory functions during the transition.
Frequently Asked Questions
Does the portal closure affect the validity of licences issued by the CGA?
No. The CGA stated on 7 October that closing the portal does not alter the validity of existing licences or operators' obligations.
Who reported access to the CGA database in the incident?
The public warning of extensive access was made by white-hat hacker Lilith Wittmann, who said broad access to CGA records and systems was obtained during the breach called "Casino Secrets."
What will the CGA do while the usual digital seal is unavailable?
The CGA will introduce an alternative mechanism for operators to demonstrate that a domain is licensed by the CGA; the authority said this will be implemented shortly but has not yet detailed the technical method or exact date.
Has the CGA published a date for the new licensing platform?
No. The authority said it is migrating to a new platform but has not set or published a launch date for that platform.
Tags
About the author
Miguel Sandoval
Regulatory Affairs Correspondent
Miguel Sandoval tracks gambling legislation, licensing, and regulator enforcement — from Spain's DGOJ and the Latin American authorities to the UKGC, the MGA, and the state-by-state map in North America. The reports answer three questions precisely — what changed, where, and who it affects — with jurisdictions, dates, and penalties cited exactly as published. Operators and compliance officers read Miguel Sandoval to know which rulebook moved before their next meeting.
More from Miguel Sandoval
