Curaçao Gaming Authority removes licensing portal after data breach
CGA shut the portal after an intrusion exposing data between Dec 2025 and Sept 2026.
Key Takeaways
- The Curaçao Gaming Authority permanently removed its compromised licensing portal after a breach detected on 17 September 2026.
- Unauthorised access affected the portal and the database between December 2025 and September 2026.
- The CGA filed complaints in Curaçao, Germany and the Netherlands and is considering civil actions in addition to criminal and administrative complaints.
- Existing CGA licences remain valid and operators must continue to meet their regulatory obligations.
- The CGA will manage the replacement platform internally and had planned a temporary portal for 19 October 2026 while preparing the permanent system.
The Curaçao Gaming Authority (CGA) permanently removed its compromised licensing portal and terminated the contract with the external provider that managed regulatory services after discovering a breach that exposed personal and confidential information of licence holders. The unauthorised access to the portal and database occurred between December 2025 and September 2026, and the CGA detected the incident on 17 September 2026.
Investigation and legal actions
The authority filed complaints in Curaçao, Germany and the Netherlands. The CGA has hired specialists to request the removal of published information and is considering civil actions in addition to the criminal and administrative complaints already lodged. An independent technical team will conduct an investigation to determine the full scope of the incident.
Internal replacement and operational measures
The CGA announced it will manage the replacement platform internally to reduce dependence on external suppliers. It had planned a temporary portal for 19 October 2026 to support applications and supervision while the permanent system was prepared; the authority said the client portal still required adjustments before testing.
The statement notes that the internal system, the digital seal and the licence registry are ready to undergo independent security checks. The digital seal allows a website to display its licence status with the CGA.
Licence status and regulatory context
Existing licences issued by the Curaçao Gaming Authority remain valid and operators must continue to comply with their regulatory obligations. The replacement of the portal takes place amid a broader regulatory reform: the National Ordinance on Games of Chance (LOK) entered into force in December 2024 and replaced master licences and sublicences with direct supervision by the CGA. Since the start of the reforms, the authority has added 14 staff for licensing, supervision and compliance. For more information on the reform, consult the regulation section.
Frequently Asked Questions
Does the portal shutdown invalidate existing CGA licences?
No. The Curaçao Gaming Authority stated that licences already issued remain valid and operators must continue to meet their regulatory obligations.
When was the data breach detected in the CGA portal?
The CGA discovered the breach on 17 September 2026 and says unauthorised access occurred between December 2025 and September 2026.
What legal measures has the CGA taken after the intrusion?
The CGA filed complaints in Curaçao, Germany and the Netherlands, hired specialists to request removal of published data, and is considering civil actions in addition to criminal and administrative complaints.
What is the CGA’s plan to replace the compromised portal?
The CGA plans to manage the replacement platform internally to reduce reliance on external providers. It had scheduled a temporary portal for 19 October 2026 to handle applications and supervision while the permanent system is prepared.
Tags
About the author
Miguel Sandoval
Regulatory Affairs Correspondent
Miguel Sandoval tracks gambling legislation, licensing, and regulator enforcement — from Spain's DGOJ and the Latin American authorities to the UKGC, the MGA, and the state-by-state map in North America. The reports answer three questions precisely — what changed, where, and who it affects — with jurisdictions, dates, and penalties cited exactly as published. Operators and compliance officers read Miguel Sandoval to know which rulebook moved before their next meeting.
More from Miguel Sandoval
