Curaçao Gaming Authority Permanently Closes Licensing Portal Following Data Breach

The Curaçao Gaming Authority (CGA) has confirmed that its online licensing portal will not return to service following an unauthorised access incident that resulted in the release of thousands of documents.

The portal, which had been operational since September 2023, will be permanently discontinued alongside associated services as the regulator transitions to a replacement system.

The decision follows a data breach that became public in September, when hacker Lilith Wittmann released more than 40,000 documents reportedly obtained after gaining unauthorised access to the platform in 2025.

In an announcement on 7 October, the CGA said:

“The CGA is taking the necessary steps to transition away from the current platform and the services associated with it, while ensuring continuity of its regulatory functions.

“The CGA acknowledges the important role that the online portal has played in supporting the implementation of Curaçao’s online gaming sector reform since 2024.”

Existing Curaçao Licences Remain Valid

The CGA stressed that the closure of the portal will not affect existing licences or change the regulatory obligations of licensed operators.

Its regulatory, compliance and supervisory responsibilities will also continue during the transition.

The authority said “alternative arrangements” are being established to maintain licensing, compliance and supervision while an interim solution is implemented for processing regulatory matters.

The CGA had indicated that further information on the arrangements would be provided no later than 9 October, although no additional details had been announced at the time of the latest update.

A separate mechanism is also expected to be introduced to allow operators to demonstrate that a domain is licensed by the CGA, as the existing digital seal will be affected by the portal’s closure.

CGA Continues Response To Data Leak

The regulator said work remains ongoing to address the unauthorised access incident and contain the resulting data leak.

“The CGA also continues its efforts in response to the unauthorised access incident, including containment of the data leak, and remains focused on protecting the integrity of its regulatory functions and information assets,” the CGA said.

“We recognise that this transition may create challenges for operators and appreciate their cooperation and understanding during this period. Further updates will be provided as additional information becomes available.”