CGA to launch temporary licensing portal after cyberattack exposes 40,000 documents

The Curaçao Gaming Authority (CGA) said it will launch a temporary licensing portal on 19 October 2026, after a cyberattack exposed more than 40,000 documents connected to the gambling sector. The regulator said it will not restore the compromised platform.

The CGA said the temporary system will handle licence applications and other regulatory tasks while it develops a long-term proprietary platform. According to the regulator, the client portal had not yet been finished, whereas the internal system, digital seal and licence register were ready for independent testing. The CGA said all systems will pass tests for potential vulnerabilities and operational issues before launch.

The intrusion stretched from December 2025 through September 2026. Lilith Wittmann, a cybersecurity researcher working from Berlin, claimed responsibility for the intrusion. The CGA said the data reportedly accessed and published includes ownership declarations, licence applications, regulatory assessments and tax documents, and that the breach affected most licensed operators.

The CGA said it had alerted authorities in Curaçao, Germany and the Netherlands. In a statement, the CGA said: "By each taking responsibility, we can improve the system, strengthen trust, and continue developing an online gambling sector that makes a substantial financial contribution to Curaçao."

According to the regulator, the breach could undermine Curaçao's reputation as an international gambling hub and erode licence holders' trust. The CGA said its priority is safeguarding confidential data and curbing how the leaked materials are used and circulated, and that it has bolstered security measures and shut down the portal for an external investigation.

The CGA said the end of the old portal does not invalidate existing licences. The source links the attack to Curaçao's 2023 gambling overhaul and the National Ordinance on Games of Chance (LOK), which replaced the old licensing system; it says authorities initially relied on external specialists for technology, licensing and supervision during the transition.