Curaçao launches temporary licensing portal after data breach

The Curaçao Gaming Authority (CGA) opened a temporary licensing portal on 19 October 2026, the authority said, after unauthorised access to its licensing system exposed personal and confidential data of licence holders. The incident, discovered on 17 September 2026, involved a German digital security researcher who accessed the externally managed portal and its database between December 2025 and September 2026 and published part of the data, according to the CGA. The CGA described the matter as serious for the authority, the sector and the people affected, and said the conduct was criminal.

The CGA took the portal offline for internal and external investigations, strengthened security measures and decided to stop using the previous system permanently. The temporary portal, which the authority said was carefully assessed, allows licence applications and supervisory work to continue while a new internally managed system is developed. The closure of the previous portal does not invalidate existing licences, and licensed companies must continue to meet their regulatory obligations, the CGA said.

To limit the spread and misuse of the stolen information, the CGA said it filed complaints and reports with authorities in Curaçao, Germany and the Netherlands, hired specialist firms to remove the leaked material from the internet and commissioned an independent forensic investigation to establish the scope of the incident and guide corrective measures. The authority is also considering civil action.

The incident comes during a reform of Curaçao's online gambling sector. In 2023, the Ministry of Finance instructed the then Gaming Control Board, now the CGA, to transform supervision, driven by international criticism of the former master-licence and sub-licence model, a rise in player complaints, adverse media coverage and commitments under agreements with the Netherlands. The new gambling law, the Landsverordening op de Kansspelen (LOK), in force since December 2024, replaced that structure.

As part of the transition, the authority brought in external technology and regulatory experts and launched the externally managed portal in 2024 while building internal capacity. Since the reform began it has hired 14 employees specialising in licensing, supervision and enforcement, with the aim of gradually reducing reliance on external advisers. The CGA said protection of personal and business data is a legal obligation and that licence holders' trust is essential; it acknowledged that organisations worldwide face cyberattack risks and said it needs to limit the damage, apply the lessons of the investigation and rebuild trust through transparent dialogue with the sector.