Curaçao’s gaming regulator has confirmed that an unauthorized account accessed its licensing portal for nine months, operating under a false identity from December 2025 through September. The Curaçao Gaming Authority (CGA) disclosed the breach this week, stating that investigations are ongoing to determine the full scope of data compromised during the intrusion.
The confirmation ends weeks of speculation within the iGaming industry about potential security vulnerabilities in one of the sector’s most widely used licensing jurisdictions. The CGA has not yet disclosed what specific information was accessed or extracted during the breach period.
Direct Impact on Licence Holders
The regulator has issued two immediate directives to its licensees following the breach confirmation. First, all licence holders have been instructed to make necessary changes on their side of the portal as soon as possible. While the CGA has not specified what changes are required, the instruction suggests that access credentials or security protocols may need updating.
Second, the authority has indicated that operators with pending matters have been followed up directly. The CGA specifically noted that if a licence was issued with open conditions, operators should expect follow-up communication from the regulator. This suggests the breach may have affected case files or compliance documentation for operators still completing their licensing requirements.
Security Questions for a Major Jurisdiction
The nine-month window during which the fraudulent account remained active raises questions about the CGA’s internal monitoring and security protocols. Curaçao has emerged as one of the most significant licensing jurisdictions in online gaming, with thousands of operators holding licences or sublicences under its framework.
The breach comes at a time when regulatory scrutiny of online gaming has intensified globally, with jurisdictions increasingly focused on data protection and cybersecurity standards. The incident may prompt other licensing authorities to review their own portal security measures and access controls.
What Operators Should Do Now
Licensees should prioritize reviewing their portal access immediately and implementing any security changes recommended by the CGA. Operators with pending compliance matters or conditional licences should prepare for regulatory follow-up and ensure all documentation is current and accessible.
The ongoing investigation means further disclosures about the scope of compromised data are likely in coming weeks. Operators may need to assess whether any sensitive business information, financial data, or customer-related documentation stored in or submitted through the portal could have been exposed.
The CGA has not provided a timeline for when the full investigation results will be published or whether any additional security measures will be mandated for licensees going forward.
