Curaçao Gambling Authority to Build In-House Portal Following Breach

Curaçao is moving faster to bring online gambling oversight entirely in-house following a breach of its licensing system that leaked confidential data belonging to permit holders. The Curaçao Gaming Authority (CGA) has scrapped its old portal and readies an interim replacement as it designs a system it can operate independently.

The security lapse has triggered formal complaints across three nations alongside an independent forensic probe. The regulator noted it is collaborating with expert firms to scrub the leaked data from the web and weighs the possibility of civil legal action.

Unauthorized access was uncovered by the CGA on September 17. Investigators determined that a German security researcher managed to enter the licensing portal and its linked database. The authority reported that this unauthorized access took place between December 2025 and September 2026, resulting in the publication of sensitive information tied to license holders.

An outside vendor oversaw the breached platform. Following the discovery, the CGA shut the portal down and opted to cut ties with the service provider permanently.

Interim Portal Keeps Regulatory Work Moving

On Monday, the regulator revealed that a temporary replacement platform was slated to go live on October 19 to maintain continuity for license applications and oversight operations.

The build-up involved rigorous technical audits and security evaluations. The CGA pinpointed its internal framework, digital seal, and official license register as elements prepared for independent security reviews, while tweaks to the client-facing portal continued.

The short-term platform is set to restore access to the license registry and digital seal alongside standard licensing functions.

The agency stressed that disabling the former portal does not invalidate active permits. Operators holding valid licenses must maintain compliance with all regulatory requirements throughout the migration period.

Breach Response Includes Cross-Border Complaints

In response to the security breach, the CGA has lodged formal grievances in Curaçao, Germany, and the Netherlands. Meanwhile, an independent forensic inquiry is underway to determine the full scope of the incident and shape necessary security upgrades.

Specialized contractors were also brought on board to track down and purge leaked details from online sources. Additionally, the regulator is weighing civil litigation, though official updates do not state that a lawsuit has officially been filed.

Licensing Reforms Underpin Plans For An Internal System

Overhaul of Curaçao’s gaming sector kicked off in 2023 when the Ministry of Finance directed the former Gaming Control Board—now the CGA—to revamp the industry. These shifts came in response to international pushback regarding the legacy master license and sub-license framework, an uptick in consumer grievances, negative press, and terms outlined in pacts with the Dutch government.

The LOK gambling legislation took effect in December 2024, supplanting the old licensing framework and subjecting operators directly to CGA oversight. Amid this shift, the agency launched an outsourced portal in 2024 to leverage external knowledge while developing its internal capabilities.

The CGA reports that it has successfully recruited 14 personnel dedicated to licensing, oversight, and compliance since the reforms began. The ultimate goal is to phase out reliance on outside consultants and independently manage a proprietary replacement portal.

“Curaçao Gaming Authority set to launch temporary licensing portal after data breach”, igamingbusiness.com, October 20, 2026

Frequently Asked Questions

What caused the Curaçao Gaming Authority to change its portal?

The CGA abandoned its previous licensing portal following a security breach that exposed confidential information belonging to license holders. An external provider managed the compromised system, prompting the regulator to terminate its services and plan an in-house platform.

When did the unauthorized access occur, and how was it discovered?

The CGA discovered the unauthorized access on September 17. Investigators found that a German security researcher had accessed the portal and database between December 2025 and September 2026, leading to the publication of confidential licensee data.

How is the regulator handling the security breach?

The CGA filed formal complaints in Curaçao, Germany, and the Netherlands, launched an independent forensic investigation, hired specialist firms to remove leaked material from the internet, and is considering civil legal action.

What happened to existing licenses when the old portal was taken offline?

Taking the previous portal offline did not cancel existing licenses. Licensed operators must continue to fulfill all regulatory obligations during the transition to the temporary platform.

Why is Curaçao reforming its gambling oversight?

Curaçao began restructuring gambling oversight in 2023 following international criticism of the former master license and sublicence model, rising player complaints, adverse media coverage, and commitments under agreements with the Netherlands. This led to the LOK gambling law taking effect in December 2024.