Curaçao Gambling Regulator Sets Out Response to Licensing Data Breach

The Curaçao Gaming Authority (CGA) plans to develop and manage a new licensing platform following a breach of an externally operated system containing confidential information about licensed businesses.

In a statement, the regulator said it discovered the breach on September 17. Its investigations revealed a security researcher from Germany had accessed the externally managed portal and its database without authorization between December 2025 and September 2026, and published information belonging to licensed operators.

The regulator has filed complaints and reported the incident to authorities in Curaçao, Germany, and the Netherlands. It has also commissioned an independent technical investigation for impact assessment, engaged specialist companies to seek the removal of any published material, and is considering civil legal action.

The portal and its database had been operated by an external company. After an initial internal investigation, the CGA took the system offline and announced that it would stop using both the platform and the provider’s regulatory services.

A temporary replacement for the portal was scheduled for October 19 to support applications and supervisory work while the authority prepares its new portal. The regulator said security testing and adjustments were required before launch. Existing licenses remain valid, and operators must continue meeting their regulatory obligations.

The incident comes as Curaçao, a long-established online gambling licensing jurisdiction, undergoes regulatory reform. The National Ordinance on Games of Chance (LOK), which took effect in December 2024, replaced the previous master license and sublicense model with direct CGA supervision of online gambling operators.