Curaçao shuts online gambling licence portal after September hack

The Curaçao Gaming Authority (CGA) has announced the permanent closure of the digital portal used to manage online gambling licences, following a data breach disclosed in September 2026. The decision was set out in a statement dated 7 October and also ends the agreements covering management services for the platform. The CGA said the portal, currently out of service, will not be reactivated.

The CGA said the shutdown does not affect the validity of licences already issued, the obligations of authorised operators or the authority's supervisory responsibilities. Licensing, compliance checks and supervision will continue through alternative procedures, and a transitional arrangement will be developed to handle administrative cases. The authority had named 9 October as the expected deadline for communicating further details on the new operating arrangements, but the statement gave no date for activating a future platform.

The closure affects the digital seals operators use to show that their sites are authorised, because the current electronic certification system allowed checks of the link between a licence and its internet domain. The CGA said it will introduce an alternative mechanism shortly so operators can demonstrate that a domain is authorised by the authority. The change also concerns payment service providers, affiliates and commercial partners, which use these checks to establish the authorisation status of platforms.

The portal had supported the reform of the island's online gambling regulation since 2024. According to Maltese press reports, the system was developed by a company led by a former official of the Malta Gaming Authority (MGA), and the CGA's decision to end the management agreements would involve that company. The CGA's statement did not identify the service provider or attribute specific responsibility for the cyber incident.

The CGA reported the unauthorised access on 17 September. It later established that the account used to enter the platform had been created in December 2025 using non-authentic identifying information. German security researcher Lilith Wittmann claimed the access, saying she remained inside the system for about nine months and that information on the authority's activities and documents submitted by operators could be consulted. The actual extent of the access remains under investigation.

Maltese press reports put the volume of information transferred at an estimated 123 gigabytes, in documents concerning folders linked to 1,355 organisations. Documents from the platform also fed into the international journalism investigation "Casino Secrets", coordinated by Dutch outlet Follow the Money with other European news organisations, which examined corporate structures, beneficial ownership and links between online gambling operators licensed in Curaçao.

The CGA said it is continuing its response to the unauthorised access, including measures to contain the spread of data, and restated its commitment to protecting the integrity of its regulatory functions and information assets. "Riconosciamo che questa transizione possa creare difficoltà agli operatori e apprezziamo la loro collaborazione e comprensione durante questo periodo", the CGA said in the official communication.