Curaçao Regulator Plans Interim Licensing Portal After Data Breach

The Curaçao Gaming Authority (CGA) plans to replace its compromised online gambling licensing portal with an interim platform while preparing a permanent system under its own management.

The regulator decided to retire the previous portal and discontinue the external provider’s regulatory services following a breach involving confidential information belonging to licence holders. The affected system was taken offline for investigation and will not reopen. 

Interim Platform Requires Security Checks

In its October 19 statement, the CGA scheduled the temporary portal’s launch for that day but also described security checks and development work that remained outstanding.

The internal system, licence register and digital seal were ready for testing by independent security specialists. The customer-facing portal still required adjustments, with security testing to follow once those changes were complete.

The interim platform is intended to support licence applications and other supervisory work. The licence register and digital seal system, which indicates that a website holds a CGA licence, were scheduled to become available alongside it.

The statement set out a planned launch date rather than confirming that the replacement system had entered operation. 

Existing Licences Remain Valid

The CGA stressed that shutting down the previous portal does not invalidate licences already issued. Licensed operators must continue meeting their regulatory obligations during the transition.

The authority is also preparing to develop and manage a permanent replacement, bringing the licensing infrastructure under internal control. 

Investigation and Data Removal Efforts Continue

According to the regulator, the breach was discovered on September 17. Its investigations indicated that unauthorised access to the externally managed portal and database occurred between December 2025 and September 2026.

The CGA said a German security researcher accessed and published personal and confidential information belonging to licence holders.

The authority has reported the incident and filed complaints with authorities in Curaçao, Germany and the Netherlands. It has also engaged specialist companies to seek removal of published material and commissioned an independent technical investigation into the breach’s impact. Civil litigation remains under consideration.

The regulator said external technology and licensing specialists were initially brought in to support Curaçao’s gambling reforms while it developed internal expertise. Responsibility for licensing and supervision remained with the CGA throughout that arrangement.