WILLEMSTAD – The Curaçao Online Gaming Association (COGA) has strongly criticized both the unauthorized access to the Curaçao Gaming Authority’s online licensing portal and the international media coverage that followed, arguing that the incident raises serious questions about cybersecurity, privacy and the portrayal of Curaçao’s online gaming industry.
COGA issued its response after German cybersecurity researcher and journalist Lilith Wittmann obtained access to the Curaçao Gaming Authority (CGA) portal. Information obtained from the system was subsequently used in an international investigation involving Follow the Money and several European media organizations.
According to COGA, Wittmann gained access under false pretenses by using a variation of the identity of a person already known to the licensing system. The industry association rejects the characterization of the operation as “ethical hacking,” arguing that it involved unauthorized entry into a restricted environment and the acquisition of confidential information.
COGA compared the incident to breaking into a secured location and taking information from it. The organization also questioned the journalistic justification for obtaining and subsequently sharing personal information belonging to entrepreneurs and shareholders.
The CGA itself confirmed earlier this week that access had been obtained through the customer-facing section of its licensing portal using an account registered in December 2025 under a false identity. The unauthorized access continued until September 2026, when it was discovered and terminated.
The regulator has said that the full extent of the information obtained remains under investigation.
COGA warned that publication of personal information involving individuals connected to online gaming companies could potentially create security risks, including for companies and individuals that have not been accused of wrongdoing.
However, the association is also critical of the CGA and the technology provider responsible for the portal. COGA said a higher and more professional level of security should have been expected and described it as troubling that sensitive information could leave the protected environment.
The association believes the incident could have consequences not only for the online gaming industry but also for Curaçao's international reputation.
COGA also challenged the way Curaçao’s gaming sector has been portrayed following publication of the leaked material.
The international investigation has raised questions about ownership structures, sources of capital and the CGA’s handling of certain license applications. Follow the Money reported that CGA employees identified concerns in some applications but that licenses were nevertheless granted, sometimes while additional information remained outstanding.
COGA argues that international reporting insufficiently distinguishes between individual operators and the wider regulated industry and too readily associates Curaçao’s sector with money laundering, player fraud and illegal gambling.
The association pointed to the major regulatory overhaul introduced through the Landsverordening op de Kansspelen (LOK), or National Ordinance on Games of Chance, which entered into force on December 24, 2024.
Under the new system, the CGA became directly responsible for licensing, supervision and enforcement. The former master-license and sublicense structure was subsequently phased out, with the transition completed in October 2025.
COGA stressed that holding a Curaçao gaming license does not automatically authorize an operator to actively offer gambling services in every country. At the same time, it argues that a company should not automatically be described as an illegal operator simply because it holds a Curaçao license.
The association said Curaçao has spent approximately 20 months transitioning from the former licensing system to the new regulatory framework while simultaneously building up the new supervisory structure.
According to COGA, international reporting has given insufficient attention to those reforms and to measures introduced by the CGA in areas including anti-money laundering controls and player protection.
The controversy comes at a sensitive moment for Curaçao's online gaming sector. The new regulatory system was intended to strengthen government oversight and improve international confidence in an industry that has faced criticism for years.
The portal breach and the documents now being examined by international journalists have instead placed both the effectiveness of the new supervision and the security of the CGA's own systems under renewed scrutiny.