Curaçao Gaming Authority portal breach: what licensees and applicants should do now
The Curaçao Gaming Authority confirmed its licensing portal was breached from December 2025 to September 2026. What leaked, and 5 steps for licensees.
)
The Curaçao Gaming Authority (CGA) has confirmed that an outsider had access to the CGA licensing portal from December 2025 to September 2026. The CGA has not yet said what was taken. The breach doesn't change Curaçao law, and the CGA has announced no change to any license. An outdated CGA file, though, is now a much bigger problem. Every Curaçao licensee should apply the portal changes the CGA sent to operators. Then check that the CGA file still matches the real business, and prepare for questions from banks and payment providers. Moving jurisdiction won't undo a leak.
What happened at the Curaçao Gaming Authority?
The Curaçao Gaming Authority announced on 17 September 2026 that it had identified unauthorized access to the CGA licensing portal. In a follow-up statement on 22 September, the CGA said the access came through the customer-facing part of the CGA licensing portal. The account, opened in December 2025 under a false identity, stayed active until September 2026.
According to the CGA, the person behind the account used a variant of a real person's name. The account also used a company that exists in the Curaçao Chamber of Commerce registry. The CGA calls the incident a serious breach under Curaçao law and says it will report it to the relevant authorities.
Berlin-based security researcher Lilith Wittmann has publicly claimed responsibility. Follow the Money (FTM), a Dutch investigative platform, published the first Casino Secrets findings on 22 September 2026. FTM worked with NDR in Germany, NRK in Norway, SVT in Sweden and Jetzt in Austria.
Curaçao isn't the first regulator in this story. In March 2026 the same researcher claimed unauthorized access to a Malta Gaming Authority (MGA) system. The MGA condemned the access in a statement on 20 March 2026.
What data did the CGA portal breach expose?
Follow the Money reports that the researcher obtained tens of thousands of confidential documents. The documents include passports, ownership details and the CGA's own assessments of applicants. The CGA hasn't confirmed this. The regulator says the full extent of the material "has not yet been established" and that the CGA "will not repeat figures it cannot verify".
According to FTM, the material includes:
license applications and the names of company owners
corporate structures submitted by applicants
personal disclosure forms describing each person's role
passports, tax returns and financial records
the regulator's own assessments of applicants, and the final recommendations of CGA officials
FTM says the files identify about 800 owners of nearly 650 licensed gambling companies. The CGA's first statement said that, at that stage, its investigation had found no compromise of the CGA's core technical infrastructure.
The last item goes beyond anything a licensee filed. The Casino Secrets material can include the CGA's own assessment of an applicant, with any open questions about ownership. FTM reports that the CGA did not dispute granting licenses while such questions were still unresolved.
What has the CGA asked Curaçao licensees to do?
The Curaçao Gaming Authority has asked online gaming operators to implement changes on their side of the CGA licensing portal "as soon as possible". The CGA's 22 September statement says the CGA has told operators about these changes. The regulator has also upgraded security in the back office and in the customer interface since 17 September 2026.
The CGA has not publicly released the content of the operator notice. If you haven't seen the notice, ask whoever manages your portal account, often your trust office or licensing advisor, to confirm it arrived. Then check the changes are done.
The CGA addressed online gaming operators. Supplier license holders should check with their licensing advisor whether the notice applies to them.
The CGA has also promised to notify individuals, applicants and licensees directly if their information may have been affected. The CGA says it will follow the applicable legal and regulatory requirements.
What should Curaçao licensees do now?
A Curaçao licensee should take five steps in this order: apply the CGA's portal changes, review portal access and check the CGA file. Then prepare for questions from banks and payment providers, and watch for fake CGA emails. The first step comes from the CGA, and the other four are our recommendations.
Apply the CGA's portal changes. Confirm that the operator notice arrived and that the requested changes are in place.
Review who holds portal access on your behalf. List everyone with CGA licensing portal credentials for your company, including trust office staff and consultants, and remove anyone who no longer needs access.
Check the CGA file against the real business. The owners, directors, key persons and compliance officer on file should be the people in those roles today. Any change goes to the CGA as a formal update, and MGL prepares and files these updates for licensees.
Prepare for questions from banks and payment providers. Banks, payment service providers and game providers run their own ownership checks, and they read the same press. Have a current structure chart and ultimate beneficial owner (UBO) documents ready.
Watch for fake CGA emails. According to Follow the Money, the researcher got in using the name of a Dutch trust office manager known to the CGA. Anyone holding application data can use the same trick in an email. Verify requests for documents or payments through a channel you already know.
If you only do one step, do step 3. A licensee whose file is accurate can face a privacy problem. A licensee whose file differs from reality can face a compliance problem, and that one is far harder to fix after the fact.
What does the breach mean for Curaçao license applicants?
For an applicant, the CGA has announced no change to application requirements, fees or timelines after the portal breach. The portal itself has changed: the CGA has added security measures in the back office and customer interface since 17 September 2026. What has changed for the applicant is the risk that a weak file becomes public.
If your application is in progress, do two things. First, apply the portal changes, review portal access and watch for fake CGA emails, because an open application sits in the same CGA licensing portal. Second, keep the ownership declaration exact, because the Casino Secrets reporting shows what a file with unanswered questions looks like once it becomes public.
If you haven't filed yet, choose a jurisdiction on the usual grounds. Those are target markets, the payment route, total cost over two years and the substance each regulator requires. A security incident alone is a weak reason to pick or reject a jurisdiction. The CGA issues each Curaçao gaming license directly under the National Ordinance on Games of Chance (LOK), in force since 24 December 2024.
Is moving to another jurisdiction the answer?
Moving jurisdiction isn't an answer to the CGA portal breach. A new license doesn't recall documents that have already left the CGA licensing portal. Every gaming regulator holds the same kind of file on an operator's owners. The Malta Gaming Authority incident in March 2026 shows that the risk isn't unique to Curaçao.
Switching first puts the questions in the wrong order. The first question is whether your current file is accurate. The second is whether Curaçao still fits your markets and payment route. A Curaçao license does not authorize play in markets that require a local license, such as Germany. Only the second question can justify a move. The breach alone doesn't change that answer. A change in how your bank or payment provider treats Curaçao would.
The reporting also questions how the CGA checked ownership during the transition to the LOK. If that leads to re-checks of existing licensees, an accurate file matters even more.
Frequently asked questions
Was my Curaçao license suspended because of the CGA breach?
No CGA statement announces any change to the status of Curaçao licenses because of the portal breach. The two statements of 17 and 22 September 2026 cover the unauthorized access, security upgrades and the investigation.
How do I know if my data was exposed in the CGA breach?
No licensee can know yet, because the Curaçao Gaming Authority says the full extent of the material has not been established. The CGA says it will notify affected individuals, applicants and licensees directly once the investigation shows who was affected.
What changes did the CGA ask operators to make?
The Curaçao Gaming Authority has asked operators to make changes on their side of the CGA licensing portal as soon as possible. The CGA has not publicly released the details, so check the notice your company received.
Who hacked the Curaçao Gaming Authority?
The Curaçao Gaming Authority describes a German security researcher. Berlin-based researcher Lilith Wittmann has publicly claimed responsibility and shared the material with Follow the Money and its media partners.
Is it still safe to apply for a Curaçao gaming license?
No regulator can promise a breach-proof portal. The Curaçao Gaming Authority says it has strengthened portal security since 17 September 2026, and neither CGA statement announces a change to application requirements. An applicant should limit portal access to the people who need it and keep the ownership declaration exact.
This article is general information, not legal advice. Confirm any change to your CGA filing with Curaçao counsel or with the CGA.
MGL prepares, files and manages Curaçao license applications for operators. Book a consultation with MGL and bring your current structure. We'll tell you which parts of your CGA file need updating, if any.
Rate This Article
Your feedback helps us improve our industry research and publish more useful insights for operators and founders. By sharing your opinion, you help our team better understand what topics matter most to professionals in the iGaming industry.