The Curaçao Gaming Authority has confirmed that a researcher gained unauthorized access to its licensing portal using a fake-identity account, remaining inside the system from December 2025 through September 2026. The breach has reportedly exposed ownership files and internal regulatory assessments for approximately 650 licensed companies, according to investigative outlet Follow the Money, which has since published the names of affected licensees.
The CGA stated it is still working to establish the full scope of what information was accessed during the nine-month intrusion. The regulator acknowledged that the unauthorized user maintained access to sensitive licensing data throughout the period, raising questions about portal security protocols and access controls at one of the iGaming industry’s most prominent licensing jurisdictions.
What Was Exposed
According to the CGA’s statement, the breach potentially encompasses two categories of sensitive information: the documentation that licensees themselves filed with the regulator, and the CGA’s own internal assessments of those applicants. Follow the Money’s reporting indicates that ownership structures, ultimate beneficial owner details, and director information may have been compromised. The exposure of the regulator’s internal evaluations represents an unusual breach, as these assessments typically remain confidential and can include risk ratings, compliance concerns, or other regulatory observations not intended for public disclosure.
The CGA emphasized that neither the exposed files nor the regulator’s assessments can be altered retroactively, meaning any discrepancies between historical filings and current business structures now exist in a public or semi-public domain.
Immediate Steps for Licensees
The authority has advised affected operators to verify that their filed information still accurately reflects how their businesses operate today, including current ultimate beneficial owners, directors, and key personnel. This recommendation suggests the regulator is concerned about potential mismatches between what was on file during the breach period and present-day corporate structures. Such discrepancies could create compliance issues or reputational risks if the exposed data contradicts current public statements or regulatory filings in other jurisdictions.
The CGA has not yet issued guidance on whether licensees should proactively update stakeholders, partners, or regulators in other markets about the potential exposure of their ownership information.
Broader Implications for the Jurisdiction
The incident arrives at a sensitive time for Curaçao’s licensing regime, which has been working to strengthen its regulatory framework and international reputation. The jurisdiction has faced scrutiny from European regulators and payment processors in recent years, prompting reforms aimed at tighter compliance standards and improved oversight. A data breach of this scale and duration may complicate those efforts and raise questions among operators about the security infrastructure supporting one of the industry’s largest licensing bases.
The CGA has not indicated whether it will conduct an external security audit or implement additional authentication measures for portal access. The regulator also has not disclosed whether any legal action is being pursued against the individual who gained unauthorized access.
