Curaçao Gaming Authority cuts ties with portal provider following data breach
The jurisdiction's gambling regulator will roll out a replacement system on 19 October after an intruder accessed and published sensitive licensee data.
- A security researcher based in Germany accessed and published confidential operator information from the Curaçao Gaming Authority's externally managed portal.
- The regulator has permanently terminated its contract with the third-party provider and scheduled an interim portal launch for 19 October.
- Existing operator licences remain valid and enforceable while independent forensic specialists evaluate the extent of the incident.
The Curaçao Gaming Authority (CGA) has shut down its licensing portal and severed ties with its third-party supplier after suffering a data breach that exposed confidential licensee documentation.
The incident came to light on 17 September, when CGA investigators confirmed that a security researcher based in Germany had secured unauthorised access to the authority's systems. The intrusion compromised both the online gambling licensing portal and its underlying database, which were hosted and maintained by an external provider.
During the breach, the intruder accessed and published personal and confidential records belonging to licence holders. The unauthorised access to the system is reported to have taken place over an extended window between December 2025 and September 2026.
Regulatory response and international legal filings
Following the discovery of the breach, the CGA isolated the infrastructure by taking the compromised portal completely offline. The regulator also acted swiftly against its technical vendor, permanently terminating the external company's regulatory services.
To counter the dissemination of the compromised files, the authority retained specialist contractors to execute takedowns of the published records across digital channels. In addition, the regulator lodged formal reports and legal complaints across multiple territories, contacting law enforcement and supervisory bodies in Curaçao, Germany, and the Netherlands.
Alongside law enforcement engagement, the CGA initiated an independent forensic investigation. This third-party examination is evaluating the overall extent of the intrusion and determining the remedial measures needed to safeguard the regulator's technical operations.
Operational continuity and licensing status
To restore regulatory functionality, the authority scheduled the deployment of a temporary licensing portal for 19 October. The watchdog emphasised that disabling the compromised portal does not invalidate any licences currently held by online gambling operators.
The CGA confirmed that all licensed companies remain fully subject to their regulatory obligations and statutory requirements while interim systems are brought online.
LOK reforms and internalisation
The breached system had been established in 2024 through the external contractor to facilitate license application processing and regulatory supervision under the island's overhaul of gambling legislation.
The LOK gambling law formally came into force in December 2024, introducing direct supervisory oversight by the CGA and replacing the jurisdiction's historical framework of master licences and sublicences.
Since the modernisation programme commenced, the CGA has worked to lower its reliance on third-party consultants and external contractors. To handle regulatory operations in-house, the authority has recruited 14 new employees specialising in licensing, supervision, and enforcement.
