Curaçao regulator opens temporary licensing portal after data breach, plans to build its own system

The Curaçao Gaming Authority (CGA) has launched a temporary licensing portal as it works to restore normal operations following a cyberattack on its online licensing system. The interim platform went live on Monday, when the regulator announced it. It will handle licence applications and other regulatory matters while a permanent replacement is built.

The move follows the regulator's decision, taken weeks earlier, to shut down its previous portal permanently rather than bring it back online after the breach. That decision also ended the CGA's relationship with the external provider behind the platform. According to the CGA, the temporary system underwent security testing, reviews of possible weaknesses and functionality checks for both operators and regulatory staff before launch. The licence register and the digital seal system, which is meant to show that a website holds a valid CGA licence, are also expected to be available through it.

In what it described as its most detailed statement since the incident, the CGA said it discovered on 17 September that a German digital security researcher had gained unauthorised access to the licensing portal in December 2025. The researcher later published confidential information linked to online gambling licensees. The regulator said the access affected a portal and database managed by an external company, and called the incident a serious matter for the regulator and the wider industry.

The CGA reported the breach to authorities in Curaçao, Germany and the Netherlands, hired specialist firms to remove the leaked information from the internet, and commissioned an independent technical investigation. It said it is also considering civil legal action. The regulator stressed that closing the old portal does not invalidate existing licences and that licensees must keep meeting their obligations during the transition.

The breach has also sped up the CGA's plans to bring more regulatory functions in-house. The original portal was introduced as part of Curaçao's gambling reform programme, which began with the LOK gambling law that took effect in December 2024, and external specialists ran it because of the technical demands involved. Since reform began, the CGA says it has expanded its internal team in licensing, supervision and enforcement. Its longer-term aim is to rely less on outside advisers and eventually operate its own portal, and it confirmed that work on a new system it will develop and manage itself is already underway.