WILLEMSTAD — The Curaçao Gaming Authority (CGA) says the breach of its online licensing portal “resulted from criminal conduct by a person who accessed the portal without authorization and took information from it”. In a statement published on 19 October 2026, the regulator said a digital security researcher from Germany had gained access in December 2025 and had accessed and published data and confidential information belonging to online gambling licence holders. It does not name the person. According to the CGA’s investigations, the unlawful access ran from December 2025 to September 2026.
What the CGA is doing
The authority says it has filed complaints and reported the incident to authorities in Curaçao, Germany and the Netherlands, hired specialist companies to remove the information from the internet and commissioned an independent technical investigation into the impact of the attack. It is also “considering civil legal action”. The portal and its database were managed by an external company, which the statement does not name. According to the CGA, the Ministry of Finance decided in the second half of 2023 to reform online gambling supervision, an externally managed portal was chosen for licence applications as part of that reform, and the authority has hired 14 employees since the reform began in 2024, mainly for licensing, supervision and enforcement.
From disclosure to a new portal
The CGA first disclosed unauthorised access on 17 September. In a follow-up dated 22 September, it said access had been obtained through the customer-facing part of the portal, using an account registered in December 2025 under a false identity, and that the full extent of the material obtained had not yet been established. On 2 October it said the portal was offline and postponed portal submission deadlines. On 7 October it announced that the portal would not return to service. The new statement says a temporary portal, including the licence register and the digital seal system, was scheduled to launch on 19 October 2026, while the CGA prepares to develop and manage a new portal of its own. The statement says the internal system, register and seal were ready for checks by independent security specialists, while the client portal used by operators still needed adjustments before its own security testing; as of 21 October the CGA had not published a confirmation that the temporary portal is open. The chart above shows the five statements in the order they appeared.
Licences stay valid
The CGA says closing the previous portal does not invalidate existing licences, and that licensed companies must continue to meet their obligations. It has not said which licence holders’ information was taken. In September it said parties whose information may have been affected would be notified directly; the latest statement says the concerns of those affected “must be heard and addressed”. Seven of the 17 projects we track are linked to entries in the CGA register of 14 October 2026, with statuses ranging from Shuffle’s indefinite licence to BetFury’s “Assessment in progress” and Rollbit’s expired entry under administrative appeal, as set out on the Rollbit risks page and in our report on that entry.
Key facts
Regulator: Curaçao Gaming Authority (CGA), formerly the Gaming Control Board.
Unlawful access: December 2025 to September 2026, via a customer account registered under a false identity; discovered 17 Sep 2026.
CGA position (19 Oct 2026): criminal conduct; complaints filed in Curaçao, Germany and the Netherlands; civil action under consideration.
Portal: externally managed, offline since September, not returning; temporary portal scheduled for 19 Oct 2026, pending security testing; no launch confirmation published as of 21 Oct.
Licences: existing licences remain valid, according to the CGA.
Why it matters for GambleFi
For crypto casinos, a Curaçao licence entry and the CGA’s digital seal are among the first things players, banks and payment firms check, and the 7 October notice said the seal would be affected by the portal’s closure. The dispute over Anjouan licences, the other jurisdiction common among the projects we track, adds to the uncertainty. Licence holders still do not know what was taken; the CGA said in September that it would state what was taken once the investigation supports it. This is a regulatory report, not legal or betting advice.