The Curaçao Gaming Authority (CGA) will not return the hacked Curaçao gaming portal to service, the regulator said in an announcement dated 7 October 2026. The CGA is moving licensing, compliance and supervision to a new regulatory platform, and the service arrangements tied to the old system end with it.
The portal has been the main channel between the regulator and licence holders since the island’s online gaming reform began in 2024, according to the CGA.
Curaçao licensees after the closure
The CGA said “the discontinuation of the portal does not affect the validity of existing licenses”. Operators’ obligations stay the same, and the authority keeps its supervisory role.
Until an interim solution is ready, licensing, compliance and supervision will run through alternative arrangements. The regulator said it was aiming to publish details of those arrangements by 9 October 2026.
The digital seal that licensed sites display to prove their status is also affected. The CGA said it will “shortly introduce an alternative mechanism” so operators can show a domain holds a CGA licence. It gave no date or technical detail.
The breach
The CGA first disclosed unauthorised access to the portal on 17 September. In a follow-up dated 22 September, it said an account had been registered on the customer-facing portal in December 2025 under a false identity, using a variant of a real person’s name and a company listed in Curaçao’s Chamber of Commerce registry.
Access continued until the CGA identified and ended it in September 2026. The authority described the intrusion as a “serious breach under Curacao law” and said it would report the incident to the relevant authorities. It has not set out the full extent of the data taken and said it would not publish figures it cannot verify.
The CGA has not named the researcher. Lilith Wittmann, a German security researcher, has published documents and ownership details from the portal on hundreds of Curaçao-licensed gambling companies under the name “Casino Secrets”. Wittmann also accessed systems at the Malta Gaming Authority (MGA) in March, when the MGA confirmed a breach of its systems.
The CGA’s 22 September statement defended its licensing record, saying it has applied due diligence procedures to applicants since the reform started and that individual documents should not be read apart from the full context of each application.
Next steps
The CGA said its response to the breach, including containment of the data leak, is ongoing. Operators are waiting for details of the interim licensing arrangements and the replacement for the digital seal. The authority has not said when the new regulatory platform will go live. More regulatory coverage is in TGE’s Regulatory Compliance section.
Source: Curaçao Gaming Authority
