Curaçao Gambling Authority closes online licensing portal after hack exposed over 40,000 documents

The Curaçao Gambling Authority (CGA) has announced that it is closing its online licensing portal, following a hacking incident in which more than 40,000 documents were publicly released. The regulator said the closure also involves ending the service arrangements that supported the portal's operation.

According to the CGA, it is taking the steps needed to phase out the existing platform and related services while keeping its regulatory functions running without interruption. The authority acknowledged that the transition may create challenges for operators and thanked them for their cooperation and understanding during the period.

The decision follows a breach disclosed on September 17, 2026, when the CGA said it had detected unauthorized access to its online gaming portal. The regulator stated that the incident had been contained and its source identified. It added that it and its service provider activated incident response procedures on detecting the breach, after which the provider began a forensic investigation.

A few days later, Berlin-based cybersecurity researcher Lilith Wittmann claimed responsibility for the hack. She reportedly accessed ownership declarations, licence applications, regulatory assessments, tax documents and other material. The leak revealed details about companies whose ownership is often hard to verify through public corporate registers.

The CGA stressed that closing the portal does not change the validity of existing licences, the obligations of licensed operators, or its own ongoing regulatory and supervisory work. It said licensing, compliance and supervisory activities will continue under alternative arrangements while an interim solution is put in place.

The regulator had indicated that further details on these arrangements would be communicated no later than October 9, 2026. As of October 12, however, it had not published any information about an interim solution, leaving operators without clarity on how licensing processes will be handled in the meantime.