The Curaçao Gaming Authority (CGA) has decided to permanently discontinue its existing licensing portal and terminate its external provider’s regulatory services following a data breach that exposed confidential information belonging to gambling license holders.
The decision comes as Curaçao continues implementing regulatory reforms under the National Ordinance on Games of Chance (LOK), which took effect in December 2024 and replaced the jurisdiction’s former master license and sublicense system with direct regulatory supervision by the CGA.
The compromised portal was introduced in 2024 as part of those reforms, with external technology and regulatory specialists engaged to support licensing applications and supervisory activities while the authority developed its internal capacity.
According to a statement issued by the CGA, investigators discovered the breach on September 17 after determining that a German security researcher had gained unauthorized access to the portal and its underlying database.
The unauthorized access reportedly occurred between December 2025 and September 2026, during which personal and confidential information belonging to license holders was accessed and published. The affected infrastructure was managed by an external provider.
The CGA subsequently took the portal offline and launched an investigation. An independent forensic examination is underway to establish the full extent of the breach and identify appropriate remedial measures.
The authority has filed formal complaints in Curaçao, Germany and the Netherlands and engaged specialist companies to remove exposed information published online. It is also considering civil litigation. To maintain licensing and supervisory operations, the CGA announced plans to introduce a temporary replacement portal on October 19, while preparing to develop a new internally managed system.
The internal system, digital seal, and license register were identified as ready for independent security assessments, while adjustments to the client portal were being completed ahead of further testing. The regulator emphasized that closing the compromised portal does not invalidate existing gambling licenses or relieve operators of their regulatory obligations.
The incident follows reforms initiated in 2023, when Curaçao’s Ministry of Finance instructed the former Gaming Control Board, now the CGA, to overhaul gambling oversight amid international criticism of the previous licensing structure, increasing player complaints, adverse media coverage and commitments under agreements with the Netherlands.
Since the reforms began, the CGA has recruited 14 employees specializing in licensing, supervision and enforcement as part of efforts to reduce reliance on external advisers and strengthen its internal regulatory capabilities.
