Curaçao Gaming Authority Portal Breach: What Is Confirmed

The Curaçao Gaming Authority has confirmed that an account created under a false identity accessed the customer-facing part of its online gaming licensing portal from December 2025 until September 2026. The regulator says the access has ended, security measures have been strengthened and a forensic investigation continues. It has not yet confirmed the full extent of the material obtained.

The CGA first disclosed the incident on 17 September 2026. It said the unauthorised access had been contained, the source had been identified and its service provider had started a forensic investigation. At that stage, investigators had not identified a compromise of the authority’s core technical infrastructure.

A follow-up dated 22 September added that access came through the portal’s customer-facing section. The account had been registered in December 2025 using a variation of a real person’s name together with an existing company in the Curaçao Chamber of Commerce register. The account remained able to access the portal until the activity was identified and stopped in September 2026.

The regulator says the investigation has not yet established the complete volume or nature of the material obtained. It has declined to repeat figures circulating in public reports until those figures can be verified. Any numerical claim about documents, companies or individuals affected should therefore be treated as unconfirmed unless the CGA publishes it or directly notifies an affected party.

The CGA has said that individuals, applicants, licensees or other stakeholders will be notified directly where the investigation determines that their information may have been affected, in line with applicable legal and regulatory requirements. That commitment is conditional on the investigation’s findings; it is not confirmation that every applicant or licence holder had information taken.

The authority’s initial statement said investigators had not found a compromise of its core technical infrastructure. That is an important limit on what is currently known, but it does not make access through a valid-looking customer account harmless. A licensing portal can contain application material, correspondence and due-diligence records even when the underlying servers or administrative systems were not technically breached.

The distinction is between the route used and the potential consequence. The confirmed route was a customer-facing account created under a false identity. The possible information exposure remains under examination. Describing the event as a total compromise of every CGA system would go beyond the regulator’s findings, while describing it as merely an account issue would understate why the investigation matters.

The CGA says it introduced extra monitoring and security measures after detection. Its later update refers to changes in both the back office and customer interface, software security upgrades and measures that online gaming operators were urged to implement on their side as soon as possible.

The public statements do not provide a technical list of those controls. That is reasonable while an investigation is active, but it means outsiders cannot yet assess whether identity verification, account permissions, session monitoring and access logging have all been remediated. The next useful evidence will be a confirmed incident scope, notification outcome and any published findings or enforcement response.

The incident does not establish that every Curaçao-licensed operator acted improperly, that every licence is invalid or that isolated application documents tell the full story of a licensing decision. The CGA says its reform-era due diligence has included evaluating submitted documents and following up on questions before reaching a licensing decision. It also acknowledges that some licensed operators may have had pending matters requiring later action.

A document appearing in material attributed to the portal should not be treated by itself as proof of misconduct. Its authenticity, date, status and place in the full application record may be unclear. Licence decisions and current status should be checked against the authority’s official records rather than an unofficial archive or social-media copy.

Players should begin with the exact casino domain, not the operator’s marketing name alone. Open the regulator certificate or seal from the casino website and confirm that the official CGA page identifies the same domain and the expected legal entity. A copied seal image, licence number written in a footer or link that does not resolve to an official CGA-controlled domain is not sufficient verification.

A Curaçao licence also does not automatically make an operator legal to use in every country. Local gambling law, restricted-country rules and the operator’s own terms still apply. Before depositing, confirm that the casino accepts players from the relevant jurisdiction, that the account details match the payment holder and that withdrawal, identity-check and complaint terms are clear.

The CGA states that it does not mediate individual player disputes, order compensation or act as a civil court. It asks players to seek resolution with the operator and use the appropriate legal channels where necessary. Complaints can still inform the regulator about a possible breach of Curaçao’s National Ordinance on Games of Chance and support risk-based supervision.

Keep copies of account statements, identity requests, payment records, withdrawal correspondence and the operator’s terms as they appeared when the dispute arose. Send sensitive evidence only through a verified operator, dispute-resolution or regulator channel. Do not upload personal documents to an unofficial breach archive or share them publicly in an attempt to prove a claim.

Curaçao’s National Ordinance on Games of Chance took effect on 24 December 2024 and moved online gaming into a reformed direct-licensing and supervisory framework. The portal is therefore part of a broader attempt to make licensing more transparent and accountable. Unauthorised access during that transition tests the security and credibility of the infrastructure supporting the new regime.

The appropriate conclusion remains narrow. The CGA has confirmed prolonged unauthorised portal access through a false-identity account and has taken containment and security steps. It has not confirmed the complete data scope, every affected party or the final consequences. Players and operators should rely on later regulator updates for those answers rather than treating estimates as established facts.

The key next steps are the forensic scope, direct notifications to affected parties, any report to Curaçao authorities and a clearer account of the controls changed after the incident. Operators should follow the security instructions sent by the CGA, review who can access regulatory submissions and be alert to phishing that uses licensing documents or regulator branding to appear credible.

Players should continue using official licence records and secure operator channels. The portal incident is a reason for careful verification, not a reason to trust leaked material or assume every Curaçao licence has the same risk. Gambling is for adults, carries a risk of financial loss and should never be treated as income.

Sources: Curaçao Gaming Authority, “Follow-up on unauthorized access to the CGA online gaming portal” (22 September 2026, official access route, duration, identity method, security response and investigative limits); Curaçao Gaming Authority, “CGA investigates unauthorized access to its online gaming portal” (17 September 2026, official containment, forensic investigation and notification commitment); Curaçao Gaming Authority, “Online Gaming” (checked 25 September 2026, official LOK and complaints guidance); and Asia Gaming Brief, “Curacao regulator says licensing portal was accessed for nine months using false identity” (24 September 2026, secondary reporting on the regulator’s follow-up). The investigation remains open; later CGA notices may change the confirmed scope.