WILLEMSTAD – The Curaçao Gaming Authority (CGA) has confirmed that confidential information belonging to online gambling license holders was accessed without authorization and published online following a security breach involving its licensing portal.
In a press release issued on October 18, the gambling regulator stated that it discovered the incident on September 17, 2026, and subsequently launched investigations and legal proceedings to address the consequences.
According to the CGA, a digital security researcher from Germany gained unauthorized access to the online gambling licensing portal in December 2025. The regulator says the individual obtained and published confidential information belonging to companies operating under Curaçao's gambling licensing system.
The CGA's investigations indicate that unauthorized access occurred between December 2025 and September 2026.
The affected portal and its database were managed by an external company responsible for providing technical and regulatory services.
The authority described the incident as a serious matter affecting the regulator, the gambling industry and the individuals and businesses whose information was exposed.
It also characterized the unauthorized access and removal of information as criminal conduct. However, the press release does not identify the individual involved or indicate whether criminal charges have been filed.
The CGA says it has submitted complaints and reported the incident to authorities in Curaçao, Germany and the Netherlands.
In addition, the regulator has engaged specialist companies to remove the compromised information from the internet and commissioned an independent technical investigation to determine the full impact and consequences of the breach.
Civil legal proceedings are also being considered.
The authority emphasized that Curaçao's legal framework requires personal and corporate information to be properly protected, including documents submitted by companies and individuals applying for online gambling licenses.
Such applications can involve sensitive corporate and personal information, making the security of the licensing system particularly important.
The CGA acknowledged that the incident has implications beyond the immediate exposure of confidential documents.
Curaçao is an internationally recognized jurisdiction for online gambling licensing, and the regulator said maintaining confidence in its supervisory system is essential to the continued operation of the sector.
According to the press release, the CGA has remained in regular contact with industry representatives while attempting to contain the consequences of the incident.
The regulator also stressed that cyberattacks can affect even well-protected organizations, although it acknowledged that this does not diminish the seriousness of what occurred.
Questions remain about the precise scale of the breach, the number of companies or individuals affected, the categories of information exposed and the security weaknesses that made the unauthorized access possible.
The press release does not provide those details or establish whether the affected information has been completely removed from public circulation.
The independent technical investigation is expected to play an important role in determining the extent of the incident and identifying measures needed to prevent similar breaches.
The CGA says it intends to use the findings to strengthen its security procedures and restore confidence among license holders.
For Curaçao, the incident raises broader concerns about the protection of confidential business information within a gambling industry that has undergone substantial regulatory reforms in recent years.