The Curaçao Gaming Authority is launching a temporary licensing portal on 19 October after a data breach exposed confidential information belonging to licence holders.
Curaçao licensing portal breach: a German security researcher accessed the portal and its database between December 2025 and September 2026. The affected system was taken offline and its provider terminated. A tested temporary portal goes live on 19 October while the CGA builds an internally managed replacement.
- How the Curaçao licensing portal Breach Happened
- Temporary Portal Replacement Begins
- Licences Stay Valid, Obligations Continue
- A Regulator Rebuilding Itself
Curaçao’s gaming regulator is replacing its licensing portal after a data breach exposed confidential information belonging to licence holders. CGA investigators found the intrusion on 17 September and traced unauthorised access to a security researcher based in Germany.
The access took place between December 2025 and September 2026, and the intruder published personal and confidential information belonging to licence holders. CGA investigators determined the affected portal and its supporting database were managed by an external provider. That provider’s regulatory services were terminated.
How the Curaçao licensing portal Breach Happened
The affected portal was taken offline after the breach was confirmed. CGA investigators are running an independent forensic process to establish how far the intrusion spread and what information was exposed.
The authority filed formal complaints in Curaçao, Germany and the Netherlands. It has also hired specialist firms to remove material that appeared online and is considering civil litigation against those responsible.
Temporary Portal Replacement Begins
CGA decided to stop using the existing portal. Licensed companies remain subject to their regulatory obligations throughout the process. The temporary portal launches on 19 October so licensing and supervision can continue.
The authority is developing and operating a new internally managed system. Before that system goes live, several components need security testing, including the internal system, the digital seal and the licence register. CGA said those three elements are ready for independent security checks.
AGBrief tracks the island’s regulatory overhaul as it moves away from its old master licence model.
Curaçao licensing portal: What Changed for Operators
The old portal is being replaced permanently, with its provider losing the contract. That ends a decade of externally managed licensing infrastructure. The new internal system will be developed and operated by the CGA.
CGA has hired 14 staff specialising in licensing, supervision and enforcement, a move intended to reduce reliance on external advisers. The regulator brought in outside technology and regulatory experts as part of the 2023 reform programme.
A Regulator Rebuilding Itself
The 2023 reform was driven by international criticism of the old master licence and sublicence model, a rise in player complaints, adverse media coverage and commitments made to the Netherlands. Curaçao’s Ministry of Finance instructed the then Gaming Control Board to rework oversight of online gambling.
The LOK gambling law took effect in December 2024 and moved supervisory control directly to the CGA. While it built internal capacity, the authority launched an externally managed portal in 2024 to process applications and supervise operators.
iGaming Business has covered Curaçao’s regulatory overhaul as the island moves away from that legacy architecture.
The temporary portal is the bridge, not the destination. CGA’s stated aim is a new system that the regulator can develop, operate and secure itself, with the digital seal and licence register passing independent checks before launch. The question for licence holders is how long the bridge will hold.
Frequently Asked Questions
When is the Curaçao licensing portal replacement going live?
The carefully tested temporary portal goes live on 19 October. It will handle licensing and supervisory tasks until the CGA’s new internally managed system is developed, tested and put into operation.
Who caused the Curaçao licensing portal data breach?
Investigators identified a security researcher from Germany who gained unauthorised access between December 2025 and September 2026. The intruder published personal and confidential information belonging to licence holders.
What is being done about the stolen data?
CGA filed formal complaints in Curaçao, Germany and the Netherlands and has hired specialist firms to remove online material. An independent forensic investigation is determining the full extent of the breach, while civil litigation is being considered.
Do existing Curaçao licences expire?
No. The old portal was taken offline, but the decision does not invalidate existing licences. Licensed companies remain subject to their regulatory obligations and must continue meeting requirements while the new system is built.
Why was an external portal manager used in the first place?
CGA launched an externally managed portal in 2024 to handle applications and supervision while it built internal capacity. It hired 14 staff for licensing, supervision and enforcement to reduce reliance on outside advisers.
What components must pass security testing?
The internal system, the digital seal and the licence register are the main components. CGA confirmed these are ready for independent security checks, while adjustments to the client portal are still being made ahead of testing.
This article has been thoroughly researched and reviewed by the CasinoBait editorial team to ensure accuracy and relevance for Asian casino players.
