The Curaçao Gaming Authority (CGA) has permanently cut ties with the outside company that ran its online licensing portal, after an unauthorized party got into the system and published confidential data belonging to license holders.
According to the regulator, its investigators established on September 17 that a security researcher based in Germany had gained access to the portal and the database behind it. The intrusion is believed to have lasted from December 2025 until September 2026. The CGA took the portal offline once the breach was discovered.
So that licensing and supervision can continue, the authority is bringing a tested temporary system online this week while it prepares a new platform to run in-house. The license register, digital seal and internal system can now go through independent security testing, the CGA said. The client-facing portal is still being adjusted before it is tested.
Shutting down the old portal has no effect on the validity of existing licenses, and license holders must still meet their compliance requirements.
The CGA has taken the case to the authorities in Germany, the Netherlands and Curaçao, and has hired specialist firms to remove leaked data published online. An independent forensic review is assessing how far the breach reached, and the regulator could also take the matter to civil court.
