The Curaçao Gaming Authority (CGA) said on 17 September 2026 that it had identified unauthorized access to its online gaming portal, the system operators and suppliers use to apply for and hold their licences. The regulator said the access has been contained and its source identified, but it has not yet established what information was reached.
Gambling regulators hold the licensing files of every operator they supervise, including corporate structures, ownership records and compliance filings, which puts their own systems at risk too.
What the CGA has disclosed
The CGA and its service provider activated incident response procedures as soon as the incident was detected, and the provider then opened a forensic investigation, the regulator said in a statement published on 17 September 2026.
While the unauthorized access has been contained, the investigation remains ongoing and has not yet established the full scope of the incident. The CGA is currently assessing whether and which information was accessed, as well as the potential consequences arising from such access.
No compromise of core infrastructure found so far
The most substantive line in the statement carries a caveat. The CGA said the investigation has not identified any compromise of the Authority’s core technical infrastructure. Given the nature of the information the CGA holds, the regulator said it would be premature to draw conclusions about the incident’s overall impact.
The distinction between the portal and core infrastructure is a common one in breach disclosures. A public-facing application can be accessed without the backend systems that store the bulk of regulatory data being reached, though the CGA has not said how the two are separated or what data, if any, sits on the portal itself.
The CGA said it is treating the matter with the utmost seriousness and has put additional monitoring and security measures in place as a precaution while the investigation continues.
Why the portal matters to licensees
The portal is the single channel for online gaming regulation in Curaçao. Operators apply for online gaming licences through it, suppliers apply for supplier licences, and licensees file periodic, incident and change reports there.
It operates under the National Ordinance on Games of Chance (LOK), which entered into force on 24 December 2024 and designated the former Gaming Control Board as the CGA. The regulator’s predecessor reopened the portal for applications in July 2024, and applicants have been directed to file documentation through it, rather than by email, ever since. Two years of licence applications, supplier filings and ongoing compliance reports have moved through the same system.
What happens next
The CGA said it is working to establish all relevant facts and will take further action if the findings warrant it.
Where the investigation determines that information relating to individuals, applicants, licensees or other stakeholders may have been affected, those parties will be notified directly and in accordance with applicable legal and regulatory requirements.
On further disclosure, the CGA said:
Further updates will be provided as appropriate as additional facts are established. As the matter remains subject to investigation and engagement with the relevant authorities, no further details can be disclosed at this time.
The statement does not say when the access occurred, how long it went undetected, who was responsible, or which service provider runs the portal. It also stops short of confirming that any data was taken. Until the CGA sets out a timeline or scope, operators and applicants who use the portal have no way to know whether their own filings were among the records reached, and the regulator has given no date for its next update.
Source: Curaçao Gaming Authority
