Curaçao opens provisional portal after nine months of unauthorized access
The Curaçao Gaming Authority resumed accepting license applications this Monday, October 19, but is doing so through an interim portal rather than the system it had been using, as that platform has been permanently decommissioned. The decision came following a data breach that exposed personal and confidential information belonging to licensees, an episode that circulated as the Curaçao Papers.
The exposure window is the most concerning aspect of the file. The incident was discovered on September 17, 2026, but the unauthorized access had begun in December 2025, meaning a German digital security researcher had access to both the portal and the database,both managed by a third-party vendor,for nine months, and published part of what was found. The authority described the episode as a serious matter for the regulator, the industry, and the affected parties, framing it as criminal conduct.
The response was three-pronged. The first layer was technical: the portal was taken offline to allow internal and third-party investigations, security protocols were tightened, and the decision was made to abandon the previous system rather than repair it. The second is legal, involving criminal complaints and reports filed with authorities in Curaçao, Germany, and the Netherlands, specialized firms hired to remove the leaked material from the internet, and the assessment of potential civil legal actions. The third is diagnostic: an independent forensic audit tasked with determining the actual scope of the incident and guiding corrective measures.
For licensees, the operational message is one of continuity. The shutdown of the old portal does not invalidate active licenses, and authorized companies remain required to comply with all regulatory obligations, while the interim portal, described by the authority as thoroughly evaluated, supports applications and supervisory tasks until a new, internally managed system is ready.
The context explains the origins of the compromised portal. Curaçao has been overhauling its online gaming sector since 2023, when the Ministry of Finance instructed the then-Gaming Control Board to revamp regulatory oversight, pressured by international criticism of the legacy master license and sub-license framework, a rise in player complaints, adverse media coverage, and commitments made in agreements with the Netherlands. The Landsverordening op de Kansspelen, in effect since December 2024, replaced that architecture, and as part of the transition, the authority brought in external technology and regulatory experts, launching the outsourced portal in 2024 while building its internal capacity. Since the start of the process, it has hired 14 specialized employees in enforcement, supervision, and licensing, aiming to gradually phase out reliance on external advisors.
The episode ultimately validates, the hard way, the decision to bring the system in-house. The outsourced portal was a transitional stopgap while the regulator built its internal team, and the breach occurred precisely in the component that was not under the authority's direct control. What aggravates the situation is not the occurrence of the attack itself,which the regulator frames as a risk faced by organizations worldwide,but that access persisted for nine months without being detected by either the vendor or the regulator. There is also an impact extending beyond Curaçao, as the Curaçao license is the credential relied upon by many operators serving unregulated markets, and just this week, a platform blocked in Chile based its legal defense on holding international licenses. With licensee data exposed, the reputational weight of that defense takes a hit at the worst possible time for a jurisdiction working to shake off its reputation for being permissive.
Tags: Curacao, CGA, data breach, gaming licenses