Curaçao Regulator Scraps Breached Licensing Portal and Schedules a Temporary Replacement

^{The Queen Emma Bridge and Handelskade waterfront in Willemstad, Curaçao. The Curaçao Gaming Authority has published its response to a data breach at its online licensing portal. (Photo: Martin Falbisoner / Wikimedia Commons)}

The Curaçao Gaming Authority (CGA) has permanently dropped the online licensing portal hit by a data breach and scheduled a temporary replacement for 19 October 2026. The regulator set out its response in a press release on its website, and said existing licences remain valid.

The CGA said it discovered on 17 September that a digital security researcher from Germany had gained access to the portal without permission. The authority took the portal offline for an external investigation. Our earlier report looked at what a Curaçao leak showed about Stake's licensing.

What the CGA Says Happened

According to the CGA's press release, the person accessed and published data and confidential information belonging to online gambling licence holders. The authority said the unlawful access took place between December 2025 and September 2026 and affected the portal and its database, which an external company managed.

The CGA called the breach criminal conduct and a serious matter for the authority, the sector, and the people involved. It said it has filed complaints and reported the incident to authorities in Curaçao, Germany, and the Netherlands, and hired specialist companies to remove the information from the internet.

An independent technical investigation has been commissioned to establish the impact and consequences of the attack. The CGA also said it is considering civil legal action and remains in regular contact with the sector, with the aim of supporting its continued operation and confidence in Curaçao as a licensing jurisdiction.

The Temporary Portal and What Comes Next

On 7 October, the CGA announced that it would permanently stop using the existing portal and end its use of the provider's regulatory services. It is preparing to build and run a new portal itself. In the meantime, a temporary portal is scheduled to launch on Monday 19 October 2026 to keep licence applications and supervision work moving.

Closing the previous portal does not invalidate existing licences. Companies with a CGA licence must continue to meet their obligations.

The licence register and the digital seal system, which shows that a website holds a CGA licence, are scheduled to return with the temporary portal. The CGA said the internal system, digital seal, and licence register are ready for checks by independent security specialists. The client portal needs adjustments first, with security testing to follow.

The authority also set the breach in the context of its wider reforms. It said it began reforming online gambling supervision in 2023, when it was still called the Gaming Control Board, and has hired 14 employees since 2024, mainly for licensing, supervision, and enforcement.

Under the Gambling Law (LOK), the CGA said, Curaçao moved away from an outdated system of master licences and sublicences that brought no financial benefit to the country, and the authority now supervises online operators directly. It listed agreements with the Netherlands, rising player complaints, negative media coverage, and the June 2024 CFATF assessment as factors behind the reform.

The CGA's homepage carries a notice that it will launch its interim online gaming portal on 19 October 2026. The LOK reaches its second anniversary on 24 December, and the CGA invited the sector to keep up the dialogue. Further findings from the independent investigation are the next development to watch. For background on the licence itself, see our Curaçao eGaming licence guide.