Curacao takes licensing in-house after nine-month breach

• CGA permanently ends its external provider’s regulatory services after the portal breach.
• Temporary portal set for 19 October as an in-house system is developed.
• Formal complaints filed in Curaçao, Germany and the Netherlands over leaked data.

The Curaçao Gaming Authority (CGA) is cutting ties with the external provider behind its hacked licensing portal and will build a replacement it runs itself.

The CGA said it planned to launch a temporary portal on 19 October to keep licensing and supervision moving until then.

The decision ends a month-long scramble that began on 17 September. That day, CGA investigators identified that a German security researcher had gained unauthorised access to the licensing portal.

In a press release issued on 19 October, the regulator said the intruder accessed and published personal and confidential information belonging to licence holders.

The CGA said the portal and its supporting database were managed by an external provider. That arrangement is over: the authority has terminated the provider’s regulatory services permanently.

Nine months undetected

According to the CGA, the access ran from December 2025 to September 2026. The account behind it was registered under a false identity, pairing a variation of a real person’s name with an existing company listed in the Curaçao Chamber of Commerce.

The intrusion came through the customer-facing side of the portal, where operators and suppliers file applications. The regulator said its investigation had so far found no evidence that its core technical infrastructure was compromised.

The CGA has called the incident a serious breach under Curaçao law and said it would report it to the relevant authorities. It has not named the person responsible.

Berlin-based security researcher Lilith Wittmann publicly claimed responsibility in September. Earlier this year, she claimed responsibility for unauthorised access to a Malta Gaming Authority (MGA) system.

Owners in the open

The leaked files soon became a reporting project. Dutch investigative outlet Follow the Money published its Casino Secrets investigation on 22 September, working with NRK, NDR, SVT and Austria’s Jetzt.

The consortium said the documents identify roughly 800 owners behind nearly 650 licensed companies. A searchable public archive of more than 40,000 documents went online the next day.

The CGA did not dispute reports that it had granted some licences with ownership questions unresolved. It disputed the characterisation of one operator network described in the coverage. It also warned against judging applications from isolated documents.

Portal goes dark

Operators felt the fallout within weeks. A CGA notice on 2 October told applicants to stop emailing documents meant for the portal and postponed filing deadlines until further notice.

Five days later, the regulator confirmed the portal would not return to service. It said existing licences remained valid, and that licensing, compliance and supervision would continue through alternative arrangements.

Its 19 October update repeats that point. Licensed companies remain bound by their regulatory obligations throughout the transition.

Issues with the seal

The temporary portal is built to restore licence applications and other supervisory processes. It also carries the licence register and the digital seal, which lets a website show that it holds a valid CGA licence.

Ahead of launch, the CGA said its internal system, digital seal and licence register were ready for independent security checks. The client portal was still being adjusted, with security testing to follow.

The permanent fix is a system the regulator will develop and operate itself. According to the CGA, it has hired 14 staff across licensing, supervision and enforcement since its reform began, to cut its reliance on external advisers.

Chasing the leak

The CGA has filed formal complaints in Curaçao, Germany and the Netherlands to limit the spread and use of the data. It has also hired specialist companies to get leaked material taken down.

An independent forensic investigation is establishing the full extent of the breach and will shape the remedial work. The authority is also weighing civil litigation, but has not said whether proceedings have started.

Reform’s weakest link

The portal was meant to support Curaçao’s regulatory overhaul. In 2023, the Ministry of Finance ordered the then Gaming Control Board to reform the sector.

The order followed international criticism of the old master licence model, rising player complaints, negative media coverage and commitments to the Netherlands.

The LOK took effect in December 2024, putting operators under the CGA’s direct supervision. Since then the regulator has added requirements ranging from remote onboarding checks to mandatory operations manuals.

Pressure on the jurisdiction is also building abroad. In July, Turkish authorities named Curaçao among the offshore hubs behind illegal betting sites targeting the country’s players.

Running the portal in-house gives the CGA full control of its security, and leaves it nowhere to point if the system fails again. Applicants with filings frozen since early October need firm processing timelines.