Curaçao Gaming Authority Confirms Nine-Month Licensing Portal Breach
The Curaçao Gaming Authority has confirmed that unauthorized access to its online gaming licensing portal continued for approximately nine months before the regulator identified and ended it in September 2026. The account was created in December 2025 under a false identity. Access took place through the customer-facing section with no confirmed compromise of core technical infrastructure.
SCCG Take — This exposes gaps in identity controls for regulatory systems. Licensees must prepare for possible data notifications and adjust compliance processes while the CGA completes its reforms.
The Curaçao Gaming Authority has confirmed that unauthorized access to its online gaming licensing portal continued for approximately nine months before detection and termination in September 2026. The account was created in December 2025 using a false identity and gained entry solely through the customer-facing section, with no confirmed breach of core technical infrastructure.
According to reporting by World Casino News, the regulator is still determining the full extent of information obtained and has declined to confirm circulating figures until its investigation concludes. Asia Gaming Brief reported the account used a variation of a real person’s name paired with an existing Curaçao Chamber of Commerce company listing. The CGA described the matter as a serious breach under local law and stated it will report the event to relevant authorities.
Breach Details and Unverified Claims
A German security researcher’s claims of portal access and extraction of operator and internal documents align with the CGA’s findings. Initial announcements on September 17 and a follow-up on September 22 detailed the timeline and confirmed that incident-response procedures were activated with a forensic investigation by the service provider. Reports referenced a publicly searchable archive with more than 40,000 documents linked to approximately 650 licensed companies and around 800 owners, though the CGA has not verified those numbers and cautioned against drawing conclusions from isolated documents.
Security Enhancements and Regulatory Next Steps
The authority has implemented additional monitoring, software upgrades on both back-office and customer-facing systems, and required changes for operators. Any affected licensees or stakeholders will receive direct notification per legal requirements. The overhaul of Curaçao’s online gaming framework that began in 2024 includes due-diligence procedures the CGA says it has followed, with post-licensing follow-ups as needed.
The ongoing investigation remains a priority. Full confirmed details on data exposure and consequences have yet to emerge, leaving licensees without complete visibility into potential risks from the incident.
Reporting: World Casino News
Generated by SCCG’s automated editorial system from published source reporting. SCCG Management holds editorial responsibility.
Gaming, betting and prediction markets — the desk’s read, every weekday.
Subscribe →