CGA pulls licensing portal after breach
The Curaçao Gaming Authority has taken its licensing portal offline after a data breach. An investigation by the regulator on 17 September found that a security researcher from Germany gained unauthorised access to the portal and its database. The CGA says that access ran from December 2025 to September 2026. Personal and confidential licensee data was published.
The portal and the database behind it were run by an external provider. After carrying out checks, the CGA decided not to put the system back into service and to end its contract with the supplier. A temporary portal goes live on 19 October, and the regulator says it has been tested thoroughly.
The CGA is also preparing its own system, to be developed and maintained in house. The internal system, the digital seal and the licence register are ready for independent security checks, the regulator says, while work on the client portal continues. Licences already issued are not annulled by the closure of the old portal.
To limit the spread of the stolen data, the CGA has filed official complaints in Curaçao, Germany and the Netherlands and brought in specialist firms to get material taken down. An independent forensic investigation is under way to establish the scale of the breach. The regulator is weighing a civil claim.
Reform in the background
The breach landed while supervision on the island is being rebuilt. In 2023 the Ministry of Finance instructed the then Gaming Control Board, now the CGA, to reform the sector, after criticism of the master-licence and sublicence model, a rise in player complaints, negative press coverage and commitments under arrangements with the Netherlands. The new LOK law took effect in December 2024, replacing the previous licensing architecture and handing the CGA direct oversight of operators. The externally managed portal launched in 2024 to cover applications and supervision while the regulator built its own capacity. Since the reform began, the CGA has hired 14 specialists in licensing, supervision and enforcement.
Operators should check what of their data may have become public and ask the regulator for specifics.
