WILLEMSTAD – The Curaçao Gaming Authority (CGA) has confirmed that an unauthorized user gained access to its online gaming licensing portal using an account created under a false identity and remained active in the system from December 2025 until September 2026.
The regulator disclosed the details in a follow-up statement issued Tuesday, September 22, after international media published reports based on information obtained by a German security researcher.
According to the CGA, the researcher claims to have gained unauthorized access to the portal and extracted information concerning Curaçao gaming operators as well as internal CGA documents.
The regulator said those claims are consistent with the findings of its own internal investigation, which led to an earlier statement on September 17.
The CGA described the incident as a serious breach under Curaçao law and said it intends to report the matter to the relevant authorities.
According to the regulator, access was obtained through the customer-facing section of its licensing portal. The account used to enter the system had been registered in December 2025 under a false identity.
The CGA said the person behind the account unlawfully used a variation of the name of a real individual and combined it with an existing company registered with the Curaçao Chamber of Commerce.
The unauthorized access subsequently continued for approximately nine months before being detected and terminated in September.
The regulator said it has not yet established the full extent of the information obtained.
“The CGA will not repeat figures it cannot verify and will state what was taken once the investigation supports it,” the authority said.
The clarification follows international reporting about confidential documents originating from the regulator’s systems. The material reportedly includes information concerning gaming companies, license applications and internal CGA documentation.
Since discovering the breach, the CGA says it has strengthened security surrounding the online gaming portal.
Several measures have been introduced in both the regulator’s back-office systems and the customer-facing interface since September 17. Software security upgrades have also been implemented.
Online gaming operators have been informed about changes affecting their side of the system and have been urged to implement the necessary measures as quickly as possible.
The CGA acknowledged the concerns caused by the incident and said the investigation is receiving the highest priority.
The regulator said additional information will be released as the investigation progresses.
For now, however, several important questions remain open, particularly how much information was obtained during the months of unauthorized access and precisely which documents or operator data were compromised.
The CGA says those answers will only be provided once they can be supported by the ongoing investigation.