Curaçao pulls plug on hacked licensing portal

• The CGA confirms its breached online gaming portal will not come back.
• Operators will get a new way to prove their domains are licensed.
• Security researcher Lilith Wittmann says she spent about nine months inside the system.

The Curaçao Gaming Authority (CGA) is shutting down its online licensing portal for good, three weeks after admitting someone had got inside it.

In a statement dated 7 October, the regulator said licensing, compliance and supervision will carry on through interim arrangements until a new platform is ready.

The contracts with the company that ran the portal end with it. The CGA has not said who that provider was. For licensees, the key message is that nothing changes on paper.

Existing licences stay valid, operator obligations still apply and the CGA keeps its supervisory powers. The Curaçao Gaming Authority said in its statement:

“We recognize that this transition may create challenges for operators and appreciate their cooperation and understanding during this period.”

Seals in limbo

The portal has been the engine room of Curaçao’s licensing reform. The regulator’s predecessor reopened it for applications on 15 July 2024, and almost every filing since has gone through it.

It also powered the digital seal, the badge operators display to prove they are licensed. Each seal links to a certificate page through an encrypted token tied to a specific domain.

Curaçao retired its orange transitional seal on 15 October 2025. Since then, a green seal has marked an active B2C licence, and B2B licensees can show a blue seal on their corporate websites.

With the portal gone, those seals are affected. The CGA says it will soon roll out an alternative mechanism so operators can still show a domain is licensed. It aimed to share details of the interim set-up by 9 October at the latest.

The timing is awkward. Licensees are still adjusting to stricter compliance demands, including new rules on B2C operations manuals.

Nine months inside

The CGA first told licensees about unauthorised access to the portal on 17 September. It later confirmed the intruder’s account had been created back in December 2025 under a false identity.

According to the regulator, the account used a variation of a real person’s name and the details of a company registered with the Curaçao Chamber of Commerce. The CGA said access came through the customer-facing side of the portal, the part operators use to submit applications. At that stage, it had found no sign that its core systems were compromised.

Berlin-based security researcher Lilith Wittmann has claimed responsibility. She says she signed up using the name of a Dutch trust office manager, her own email address and a made-up company, and was approved within days.

Her account of what she could see goes further than the CGA’s. She says she was able to watch the regulator at work in real time.

Wittmann, who is associated with the Chaos Computer Club, is no stranger to gambling regulators. She claimed a similar MGA portal breach in March.

What the portal hosted is the real concern. According to law firm Legal Bison, it held personal history disclosure forms for owners, directors and financiers, plus passports, tax returns, CVs and criminal record data.

The CGA has tightened security on both the back office and the operator-facing side, and its forensic investigation is still running.

Casino Secrets fallout

Wittmann’s haul became the basis for Casino Secrets, an investigation led by Dutch outlet Follow the Money. NRK, NDR, SVT and Jetzt joined the project.

The files put names to the companies behind some of the biggest offshore brands. Data from December 2025 showed 646 organisations holding a Curaçao licence. The reporters verified 897 beneficial owner records covering 767 individuals.

In its defense, the CGA points to its track record. It says it has run due diligence checks since 2024 and has turned down about 28% of applications since 2023.

Trust on trial

For now, the CGA is staying cautious. It says it will not repeat figures it cannot verify and will only confirm what was taken once its investigation is complete.

That leaves the people named in the files with few options. According to Legal Bison, Curaçao’s Data Protection Ordinance requires data to be kept secure but includes no general duty to notify people of a breach.

The more immediate headache is commercial. Payment providers, affiliates and platform partners routinely check a Curaçao seal before onboarding a brand. Until the new mechanism is live, that check gets harder.

Regulators elsewhere now have something they rarely get: a detailed look at who actually sits behind Curaçao-licensed brands. Expect that to surface in licensing reviews and enforcement cases far from the Caribbean.

The CGA’s new platform will be judged on one thing. It needs identity checks strong enough to stop someone registering with a borrowed name and a generic Gmail address.