Curaçao Regulator Shifts Portal Strategy After Data Breach

Curaçao’s efforts to bring online gambling regulation under greater internal control have gained urgency following a breach of the licensing system that exposed confidential information belonging to licence holders. The Curaçao Gaming Authority (CGA) has abandoned its previous portal and is preparing a temporary replacement while planning a system it can manage itself.

The incident has prompted complaints to authorities in three countries and an independent forensic investigation. The regulator said it is working with specialist firms to remove leaked material from the internet and is considering civil legal action.

The CGA discovered the unauthorized access on 17 September. Investigators found that a German security researcher had accessed the licensing portal and its associated database. According to the authority, the access occurred between December 2025 and September 2026, and confidential information belonging to licence holders was published.

The compromised system was managed by an external provider. The CGA took the portal offline after discovering the breach and decided to terminate the provider’s regulatory services permanently.

Interim Portal Keeps Regulatory Work Moving

The regulator announced on Monday that a temporary replacement was scheduled to launch on 19 October. The platform is intended to keep licence applications and supervisory work operating.

Preparations have included technical reviews and security testing. The CGA identified its internal system, digital seal and licence register as components ready for independent security checks, while further adjustments to the client portal remained underway.

The temporary platform is expected to make the licence register and digital seal available alongside licensing services.

The authority has clarified that taking the previous portal offline does not cancel existing licences. Licensed operators must continue to meet their regulatory obligations during the transition.

Breach Response Includes Cross-Border Complaints

The CGA has filed formal complaints in Curaçao, Germany and the Netherlands following the unauthorized access. An independent forensic investigation is examining the incident to establish its extent and identify necessary remedial measures.

Specialist companies have also been engaged to seek the removal of information published online. The authority is considering civil litigation, although the supplied statements do not confirm that proceedings have begun.

Licensing Reforms Underpin Plans For An Internal System

Curaçao began restructuring its gambling oversight in 2023, when the Ministry of Finance instructed the then Gaming Control Board, now the CGA, to reform the sector. The changes followed international criticism of the former master licence and sublicence model, a rise in player complaints, adverse media coverage and commitments under agreements with the Netherlands.

The LOK gambling law came into force in December 2024, replacing the earlier licensing structure and placing operators under the CGA’s direct supervision. During the transition, the regulator introduced an externally managed portal in 2024, relying on outside expertise while building its own capacity.

Since the reforms began, the CGA says it has hired 14 staff focused on licensing, supervision and enforcement. It aims to reduce dependence on external advisers and eventually operate a replacement portal itself.