According to the regulator, the account was created in December 2025 using a variation of a real person’s name together with the details of an existing company registered with the Curaçao Chamber of Commerce. The unauthorized access continued until September 2026, when the Curaçao Gaming Authority’s portal was hit by hackers who were later identified and stopped.
The access took place through the customer-facing part of the licensing portal, which is used by operators and suppliers to submit license applications and other regulatory information. The CGA said its investigation has so far found no evidence that its main technical systems were compromised, although it’s still working to establish exactly what information may have been viewed or obtained.
Reports have referred to a large number of documents allegedly taken from the portal, including information linked to licensed companies and their owners; however, the CGA hasn’t confirmed the figures circulating publicly and said it needs to complete its investigation before understanding the full scope of the incident.
The CGA shared:
“The CGA considers this as a serious breach under Curaçao law, is unacceptable, and will pursue reporting of this event to the relevant Authorities. The CGA will not repeat figures it cannot verify and will state what was taken once the investigation supports it.”
The regulator has since added further security measures to both the back-office and customer-facing parts of the portal, along with software updates. It has also informed online gaming operators about security changes they need to make on their side.
