Curaçao Gaming Authority launches temporary portal after data breach

The Curaçao Gaming Authority (CGA) has begun rolling out a temporary replacement for its online gambling licensing portal after discovering that confidential licence holder data had been accessed and published without authorisation, according to iGaming Business.

The regulator said in a press release issued on Monday that the breach was uncovered on 17 September, when investigators found that a security researcher based in Germany had gained unauthorised access to the licensing portal and its underlying database.

The CGA said personal and confidential information belonging to licence holders had been accessed and made public as a result. The unauthorised access is believed to have taken place between December 2025 and September 2026.

The affected portal and its database were run by an external provider rather than the CGA itself. Once the breach was identified, the authority took the system offline while it investigated.

The CGA has now decided to stop using that portal altogether and to permanently end the provider's regulatory services. A temporary portal, described as carefully tested, was due to go live on 19 October so that licensing and supervisory work could continue uninterrupted.

Work is also under way on a new system the CGA intends to develop and run internally. Several components, including the internal system, digital seal and licence register, were described by the authority as ready for independent security checks, while adjustments continue on the client-facing portal ahead of further testing.

The CGA stressed that closing the old portal does not affect the validity of existing licences, and that licensed operators remain bound by their regulatory obligations throughout the transition.

To limit the spread of the stolen data, the authority said it has filed formal complaints in Curaçao, Germany and the Netherlands, and has engaged specialist firms to pursue the removal of material that has already appeared online. An independent forensic investigation is under way to determine the full scope of the breach, and the CGA said it is considering civil litigation.

The incident lands in the middle of a broader overhaul of how Curaçao licenses and supervises online gambling operators. The island's Ministry of Finance instructed the then Gaming Control Board, now the CGA, to reform sector oversight in 2023, following international criticism of the old master licence and sublicence model, a rise in player complaints, negative media coverage and commitments made under agreements with the Netherlands.

The LOK gambling law, in force since December 2024, scrapped the previous licensing structure and gave the CGA direct supervisory authority over operators. As part of that transition, the authority brought in outside technology and regulatory specialists and launched the externally managed portal now at the centre of the breach in 2024, intended as a bridge while it built up internal capability.

The CGA said it has since hired 14 staff across licensing, supervision and enforcement, as it works to reduce its dependence on external advisers.