Curaçao Replaces Gaming Licensing Portal Following Major Data Breach
Curaçao.- 21 October 2026 | www.zonadeazar.com The Curaçao Gaming Authority (CGA) has announced plans to introduce a temporary online gambling licensing portal following a serious data breach that exposed confidential information belonging to licensed operators.
The regulator confirmed that the incident was discovered on 17 September 2026, when investigators identified unauthorised access to its digital licensing platform and associated database.
The authority has decided to permanently discontinue the compromised system and develop a replacement platform under its direct management.
Unauthorised Access Over Nine Months
According to the CGA’s investigation, a cybersecurity researcher based in Germany gained unauthorised access to the licensing portal and information belonging to licence holders.
The activity reportedly occurred between December 2025 and September 2026.
The principal consequences identified include:
- Exposure of personal and confidential operator information.
- Unauthorised access to the licensing database.
- Publication of sensitive documents online.
- Temporary disruption of digital licensing services.
The affected platform and its supporting database were managed by an external technology provider.
Following the discovery, the authority took the portal offline and launched an investigation into the extent of the incident.
Replacement Portal and Security Measures
The CGA announced a temporary replacement designed to maintain regulatory licensing and supervisory activities.
The authority identified 19 October 2026 as the intended implementation date, subject to the necessary technical and security checks.
The components under review include:
- Internal regulatory management system.
- Official licence register.
- Digital verification seal.
- Operator-facing client portal.
The regulator confirmed that it will permanently discontinue its relationship with the previous regulatory services provider and develop a new internally managed platform.
Existing gambling licences remain valid, and operators must continue meeting all applicable regulatory obligations.
Investigations and Potential Legal Action
The CGA has filed formal complaints in Curaçao, Germany and the Netherlands in connection with the unauthorised access.
It has also engaged specialist companies to help remove confidential material published online.
An independent forensic investigation is under way to establish the full extent of the breach and identify appropriate remedial actions.
The regulator is also considering civil litigation against those responsible.
Next Steps and Impact
The incident comes as Curaçao continues modernising its gambling regulatory framework under the National Ordinance on Games of Chance (LOK), which entered into force in December 2024.
The legislation replaced the previous sublicensing system and introduced direct regulatory supervision by the CGA.
As part of the reforms, the authority has recruited 14 specialists in licensing, supervision and enforcement, seeking to reduce its dependence on external advisers.
The data breach highlights the growing importance of cybersecurity, data protection and technological independence for authorities overseeing the international iGaming industry.
Editó: @fonta
