Curaçao Gaming Authority retires compromised licensing portal after breach
CGA took the external portal offline after unauthorised access spanning Dec 2025–Sep 2026.
Key Takeaways
- The Curaçao Gaming Authority retired its externally managed licensing portal after unauthorised access between December 2025 and September 2026.
- The CGA discovered the breach on 17 September 2026 and filed complaints in Curaçao, Germany and the Netherlands.
- A temporary portal had a target launch of 19 October 2026 while the CGA builds an internal replacement and readies the digital seal and licence register for security checks.
- Existing CGA licences remain valid and operators must continue meeting regulatory obligations.
The Curaçao Gaming Authority permanently retired its externally managed licensing portal and ended use of the third-party provider after an unauthorised access incident that exposed personal and confidential data belonging to gambling licence holders. The regulator discovered the breach on 17 September 2026 and said the intruder accessed the portal and database between December 2025 and September 2026.
Immediate actions and legal steps
The CGA filed complaints in Curaçao, Germany and the Netherlands and has hired specialists to pursue removal of published information. The authority is considering civil action in addition to those complaints. An independent technical investigation will determine the full impact of the incident.
Replacement systems and testing
The CGA said it will manage the replacement platform internally to reduce reliance on outside providers. It had planned a temporary portal to support applications and supervision with a target launch date of 19 October 2026, while preparing a permanent system. The regulator identified its internal system, the digital seal and the licence register as ready for independent security checks, but said the client portal still required adjustments before testing.
Regulation and continuity
Existing CGA licences remain valid and operators must continue to meet their regulatory obligations. The digital seal enables a website to display its CGA licensing status; the licence register is earmarked for verification in the independent review.
Wider reform context
The replacement comes amid an overhaul of Curaçao gambling regulation under the National Ordinance on Games of Chance (LOK), which took effect in December 2024 and replaced master licences and sublicences with direct CGA supervision. Since the reforms began, the authority has recruited 14 employees for licensing, supervision and enforcement. The CGA says the incident does not cancel licences and that not all replacement services had been confirmed operational at the time of its statement.
Frequently Asked Questions
When did the CGA discover the breach to its licensing portal?
The CGA discovered the breach on 17 September 2026. The authority said the unauthorised access occurred between December 2025 and September 2026.
Do existing Curaçao licences remain valid after the portal retirement?
Yes, existing CGA licences remain valid. The CGA stated that licence closure does not invalidate licences and operators must continue to meet compliance obligations.
What legal actions has the CGA taken following the breach?
The CGA filed complaints in Curaçao, Germany and the Netherlands and has hired specialists to seek removal of published information. The authority is also considering civil action alongside those complaints.
When was the temporary portal due to be launched?
The temporary portal had a target launch date of 19 October 2026. It was intended to support applications and supervision while the permanent system was prepared.
How is the CGA handling its replacement platform?
The CGA plans to manage its replacement platform internally to reduce reliance on outside providers. The regulator identified its internal system, the digital seal and the licence register as ready for independent security checks, while the client portal still required adjustments before testing.
Tags
About the author
Eleanor Whitfield
Regulatory Affairs Correspondent
Eleanor Whitfield tracks gambling legislation, licensing decisions, and regulator enforcement across key markets — from the UKGC, MGA, and Germany's GGL to Spain's DGOJ and the state-by-state map in the Americas. The reporting answers three questions precisely: what changed, where, and who it affects, with jurisdictions, effective dates, and penalty figures named exactly as published. Compliance officers and operators read Eleanor Whitfield to know which rulebook moved before their next board meeting.
More from Eleanor Whitfield
