Curaçao Gaming Authority Shuts Portal After October Cyberattack

The Curaçao Gaming Authority announced on 7 October that it will shut down its online gaming portal after last month’s “Casino Secrets” data breach and will not restore the compromised platform. The regulator said it will continue licensing, compliance and supervisory duties through alternative arrangements while it migrates to a new system; it also confirmed existing licences remain valid.

Curaçao Gaming Authority portal shutdown: what the regulator said

The Curaçao Gaming Authority (CGA) released the statement on 7 October after a security incident identified in the previous month. White-hat hacker Lilith Wittmann disclosed that attackers had gained extensive access to the CGA’s database and systems; the breach is widely referred to as the “Casino Secrets” incident. The authority has decided not to reinstate the hacked portal and will switch to a new platform to carry out its licensing activities.

The CGA made several specific declarations in its statement:

• the discontinuation of the portal does not affect the validity of existing licences;

• the obligations of licensed operators remain unchanged;

• the CGA’s regulatory and supervisory responsibilities continue through alternative arrangements;

• an interim solution will be introduced to replace the portal’s functions.

The authority said it recognises this transition may create challenges for operators and requested their cooperation during the changeover.

How the portal shutdown affects licensed operators

Operators licensed under Curaçao gaming law keep their licences in force despite the portal being taken offline. The CGA emphasised that licence validity, operator obligations and ongoing supervision are unaffected by the technical change. Compliance teams should therefore continue to meet regulatory duties under the same legal framework while working with the CGA’s interim processes.

The CGA warned that the availability of its current digital seal will be disrupted and committed to providing an alternative mechanism for operators to demonstrate that a domain is licensed by the CGA. The authority did not publish technical details of the interim mechanism in the 7 October announcement, nor did it set a launch date for the replacement platform.

Incident background: the Casino Secrets breach and data exposure

Security researchers and the individual who flagged the incident, Lilith Wittmann, reported that the breach exposed sensitive documents and ownership information for several gambling companies licensed in Curaçao. The CGA confirmed it is engaged in containment activities aimed at stopping further leaks and protecting the integrity of its regulatory functions and information assets.

The authority said it is continuing its response to the unauthorised access, including containment of the data leak, while shifting operational workflows off the compromised portal. The CGA offered no timeline in the public release for forensic completion or final remediation of the compromised systems.

Regulatory continuity and interim arrangements

The CGA has stated that licensing, compliance and supervision activities will continue using alternative arrangements and an interim solution while the new platform is prepared. That means:

1. casework and supervision will be routed through non-portal channels agreed with operators;

2. licensing applications and renewals will be processed via temporary workflows until the replacement system is live;

3. the CGA will provide operators with the alternative mechanism for proving domain licensing when the digital seal becomes unavailable.

Operators should expect communications from the authority setting out the precise interim operational steps. The CGA thanked industry stakeholders for their cooperation and asked operators to adopt the temporary processes the authority introduces.

What remains unknown and what operators should do now

The CGA did not announce a specific date for the launch of the replacement platform, leaving the timeline for full restoration of digital services open. The statement makes clear that the CGA will not reinstate the compromised portal, but it did not publish a schedule for the interim mechanism or the new platform’s go-live.

Operators should document their interactions with the CGA under the interim arrangements and retain evidence of compliance while the authority changes systems. They should also monitor CGA communications for the forthcoming alternative for the digital seal and be prepared to prove domain licensing through the mechanism the regulator introduces.

Wider implications for the Curaçao market

The CGA’s decision to withdraw the compromised portal and migrate to a new platform preserves licence continuity while addressing security concerns. The authority’s public focus is containment of the leak and protection of regulatory information. How long the interim arrangements will remain in place will depend on the CGA’s internal remediation and platform replacement timetable.

Operators and service providers affected by the incident should expect further directives from the Curaçao Gaming Authority and prepare to adopt the interim processes for licensing and supervision until the CGA confirms the new platform’s launch.

“The discontinuation of the portal does not affect the validity of existing licenses, the obligations of licensed operators, or the CGA’s ongoing regulatory and supervisory responsibilities,” the Curaçao Gaming Authority said in its 7 October release. — Curaçao Gaming Authority

“Given that the availability of the current digital seal will be affected, the CGA will shortly introduce an alternative mechanism through which operators can demonstrate that a domain is licensed by the CGA,” the authority added. — Curaçao Gaming Authority

For regulatory context and comparison with other jurisdictions’ responses to breaches, see the regulation section and for industry reaction to the platform change see the news pages.