Curaçao Gaming Authority Investigates Unauthorised Access To Online Portal

The Curaçao Gaming Authority (CGA) has reported unauthorised access to its online gaming portal, with an investigation now underway to establish what information may have been accessed.

The incident was disclosed by the regulator on 18 September. The CGA said the unauthorised access had been contained and that the source of the access had been identified.

The regulator and its service provider activated their incident response procedures after detecting the incident, while the provider began a forensic investigation.

“Upon detection of the incident, the CGA and its service provider immediately activated their incident response procedures and its provider commenced a forensic investigation to determine what happened,” the CGA said.

“While the unauthorised access has been contained, the investigation remains ongoing and has not yet established the full scope of the incident.

“The CGA is currently assessing whether and which information was accessed, as well as the potential consequences arising from such access.”

Investigation Continues

The CGA said its investigation has not identified any compromise of its core technical infrastructure.

However, the regulator said it was too early to determine the overall impact of the incident given the nature of the information held by the authority.

The CGA said it was treating the investigation with “utmost seriousness” and had introduced additional monitoring and security measures as a precaution while the investigation continues.

The regulator added that it would take further action if warranted by the findings of the investigation.

“Where the investigation determines that information relating to individuals, applicants, licensees, or other stakeholders may have been affected, those parties will be notified directly and in accordance with applicable legal and regulatory requirements.”

The CGA said it recognised the concerns the incident could cause among affected parties and reiterated its commitment to transparency.

“Further updates will be provided as appropriate as additional facts are established.”

The authority said it could not disclose further details while the investigation and engagement with the relevant authorities remained ongoing.

The incident follows a separate cyberattack involving the Malta Gaming Authority in March 2026, when the regulator reported a data breach.