The Curaçao Gaming Authority has permanently discontinued its online licensing portal and replaced it with a temporary system, after a data breach exposed more than 40,000 confidential documents belonging to licensed gambling companies.
In a press release issued on Monday, the CGA said it planned to launch a temporary replacement of the system on Tuesday in response to the breach.
The move affects licensing and supervisory processes for hundreds of operators and suppliers that rely on Curaçao authorisation.
What happened
The breach was discovered on 17 September when CGA investigators determined that a security researcher from Germany had gained unauthorised access to the authority’s licensing portal and its database.
The intruder had accessed and published personal and confidential information belonging to licence holders, with the unauthorised access said to have occurred between December 2025 and September 2026.
The CGA said the affected portal and its supporting database were managed by an external provider.
Trade press reporting has linked the breach to Berlin-based researcher Lilith Wittmann, who used an access-control vulnerability to hold administrative-level access to the system for roughly nine months before the leak surfaced publicly. The resulting archive, covering companies licensed as of December 2025, included ownership declarations, licence applications, passports, tax records and the regulator’s own internal assessments.
Following the breach and subsequent investigations, the CGA decided to stop using the existing portal and terminate the provider’s regulatory services permanently, launching a carefully tested temporary portal on 19 October to allow licensing work and supervisory tasks to continue.
The regulator also confirmed it reported the breach to authorities in Curaçao, Germany and the Netherlands, hired specialist firms to remove leaked information from the internet and commissioned an independent technical investigation into the incident.
The CGA said it is also considering civil legal action.
Why it matters
For operators holding Curaçao licences, the immediate practical concern is continuity of service during the transition rather than the validity of existing authorisations.
Existing license holders are not expected to be affected while a new platform is introduced, but the move ends the current application system and related services.
Firms with applications mid-process face uncertainty over processing timelines until the regulator’s permanent internally managed system is in place.
The reputational dimension is arguably more significant than the operational one.
The leak exposed tens of thousands of confidential documents, including owners’ names, licence applications and the regulator’s own assessments, with passports, tax returns and sensitive financial information in the cache.
That level of exposure invites renewed scrutiny of beneficial-ownership structures across the Curaçao licensing base, at a time when banking partners, payment processors and B2B suppliers are already applying heightened due diligence to offshore-licensed brands.
Political pressure has compounded the regulator’s difficulties.
An opposition politician has demanded the CGA director’s resignation and warned of possible compensation claims, saying the CGA had not sufficiently explained the reasons for the decision.
That dynamic adds a governance question to what began as a technical security failure, and it will shape how quickly the authority can restore full confidence in its digital infrastructure.
The bigger picture
Curaçao has spent the past two years overhauling its licensing framework, moving from a master-licence system to direct regulator oversight via the CGA, with the breached portal central to that reform. A collapse of the underlying technology just as the new regime was bedding in complicates the regulator’s efforts to present Curaçao as a credible, professionalised jurisdiction rather than a looser offshore option.
The episode also lands amid wider pressure on offshore licensing models, as regulators in better-established markets continue to tighten scrutiny of operators and payment flows tied to loosely supervised jurisdictions. Suppliers and affiliates working with Curaçao-licensed brands will want clarity on how quickly the authority’s promised internally managed system replaces the current interim arrangement, since prolonged uncertainty over licensing infrastructure can affect partner confidence and commercial terms as much as any single compliance breach.
For more coverage of regulatory and licensing developments shaping the sector, visit our industry news section.
Sources
- iGaming Business – Curaçao Gaming Authority set to launch temporary licensing portal after data breach
- Gambling News – Cyberattack Forces Curaçao Regulator to Launch Temporary Online Portal
- iGaming Today – Curaçao Regulator to Launch Temporary Licensing Portal After Major Data Breach
- Casino Press Wire – Curaçao Gaming Authority Shuts Licensing Portal After Hack Exposes 40,000 Documents
- Vantegris – Curaçao CGA Portal Leak: What Operators Should Do Now
Leave a Reply