The Curaçao Gaming Authority has confirmed that unauthorized access to its online gaming licensing portal continued for approximately nine months before the regulator identified and ended it in September 2026.
The account involved in the incident was created in December 2025 under a false identity. Access took place through the customer-facing section of the licensing portal and did not involve a confirmed compromise of the authority’s core technical infrastructure.
The regulator continues to investigate what information was obtained. It has declined to verify figures circulating publicly about the amount of material involved until the investigation establishes the full scope of the incident.
False Identity Used to Gain Portal Access
Asia Gaming Brief reported that the account was registered using a variation of a real person’s name together with an existing company listed in the Curaçao Chamber of Commerce registry.
The account remained active from December 2025 until September 2026. The CGA said the access was unauthorized and described the incident as a serious breach under Curaçao law.
The regulator’s September 22 official follow-up announcement [pdf] came after international reports in which a German security researcher claimed to have accessed the portal and extracted information relating to Curaçao operators and internal CGA documents.
The CGA said those claims were consistent with the findings of its own investigation.
“The CGA considers this as a serious breach under Curacao law, is unacceptable and will pursue reporting of this event to the relevant Authorities,” the regulator stated.
The authority has not established the full extent of the material obtained. It said it would avoid repeating figures that investigators had not verified and would provide confirmed information once the evidence supported doing so.
Reports surrounding the incident have referred to a publicly searchable archive said to contain more than 40,000 documents linked to approximately 650 licensed companies and around 800 owners. The available reports also stressed that appearing in the archive does not by itself indicate improper or illegal conduct.
The CGA has not confirmed those figures.
Initial Investigation Found No Core Infrastructure Breach
The regulator first publicly addressed the incident in an official announcement [pdf] dated September 17.
In that statement, the Curaçao Gaming Authority said it had identified unauthorized access to its online gaming portal and had already contained it. The authority said it had also identified the source of the access.
The CGA and its service provider activated incident-response procedures following the detection. The service provider then began a forensic investigation to determine how the incident occurred and what information may have been accessed.
At that stage, investigators had not identified any compromise of the regulator’s core technical infrastructure.
The CGA said it was still assessing which information had been viewed or obtained and what consequences could result from the incident. Because of the type of information held by the regulator, it said it was too early to reach conclusions about the overall impact.
The announcement also stated that additional monitoring and security measures had been introduced while the investigation continued.
The authority said any individuals, applicants, licensees or other stakeholders found to have been affected would receive direct notification in line with applicable legal and regulatory requirements.
The September 22 follow-up provided further details about how the portal had been accessed and established the period during which the unauthorized account remained active.
Security Measures Strengthened After Discovery
Since the first public announcement, the CGA has introduced additional measures covering both the back-office side of its online gaming portal and its customer-facing interface. The regulator has also implemented software security upgrades.
Online gaming operators have been informed about changes required on their side and have been urged to introduce those measures as soon as possible.
The CGA also addressed questions about its licensing procedures following reports based on documents allegedly obtained from the portal. The regulator said it has followed internal due-diligence procedures since Curaçao’s online gaming reform began in 2024. That process involves evaluating documents submitted by applicants and following up on outstanding questions before the authority forms an opinion on whether to grant a licence.
The CGA acknowledged that licensed operators could still have pending matters requiring further action after a licence decision. It said those issues were followed up as required.
The authority also cautioned against reaching conclusions about its licensing decisions by examining individual documents separately from the wider context of an application.
Curaçao has been implementing a broader overhaul of its online gaming framework, including new requirements affecting operators and suppliers under the reformed regulatory system.
The portal investigation remains ongoing. The CGA said it continues to treat the incident as a priority and will release additional information as investigators establish further facts.