Curaçao's Regulator Calls Its Portal Breach Criminal Conduct, but Its Own Timeline Shows Nine Months Undetected

The Curaçao Gaming Authority has set out its fullest account yet of the breach of its licensing portal, blaming a German researcher and weighing civil action. The same document dates the unlawful access from December 2025 to September 2026, and says nothing about what was taken or who has been told.

• The Curaçao Gaming Authority (CGA) says it discovered on 17 September that a security researcher from Germany had entered its online licensing portal without permission in December 2025, and that unlawful access continued until September 2026
• It calls the breach "criminal conduct", has filed complaints in Curaçao, Germany and the Netherlands, hired specialists to remove the published data, commissioned an independent technical investigation and is considering civil action
• The portal and its database were run by an external company, chosen as part of the reform that began in 2023, and the CGA has hired 14 staff since 2024 while saying it always remained responsible for licensing and supervision
• A temporary portal carrying the licence register and digital seal was scheduled for 19 October, after the CGA abandoned the breached system on 7 October; by 20 October an invitation-only sign-in page was live, but no launch notice had been published
• The release does not say what was taken, how the access was found, or whether affected licence holders have been notified, as the CGA promised in September

The Regulator's Account Moves From Incident to Crime

The Curaçao Gaming Authority (CGA) published "Data breach at CGA: from investigation to action" on 19 October, its longest statement since it first disclosed unauthorised access to its licensing portal in September. According to the release, the CGA discovered on 17 September that a digital security researcher from Germany had gained access to its online gambling licensing portal "without proper permission" in December 2025, and had accessed and published data and confidential information belonging to licence holders.

The CGA says the breach "resulted from criminal conduct by a person who accessed the portal without authorization and took information from it". It has reported the incident to authorities in Curaçao, Germany and the Netherlands, hired specialists to remove the information from the internet, commissioned an independent technical investigation and is "considering civil legal action". The release does not name the researcher. Lilith Wittmann, a Berlin-based researcher, has said publicly that she was inside the regulator's systems for nine months, and the archive she published with European media partners states that it holds 40,000 documents.

According to the CGA, unlawful access ran from December 2025 to September 2026 and affected the portal and its database, "which were managed by an external company", which it does not name. Random Consulting Limited, a Malta-based firm associated with consultant Mario Galea, has said it designed, developed, hosts and maintains the portal, and the Curaçao Chronicle reported that closing the portal ended the CGA's contract with Galea and his company. On 7 October the CGA spoke of concluding "service arrangements supporting the platform"; the new release says it is ending its use of "the provider's regulatory services".

Why the Portal Was Outsourced

The release gives the CGA's first public account of how the arrangement came about. The reform began in 2023, when the CGA was still the Gaming Control Board, under instructions from the Minister of Finance, and the CGA cites the agreements with the Netherlands under the Country Package, rising player complaints, negative media coverage and the Caribbean Financial Action Task Force (CFATF) assessment of June 2024. The Ministry of Finance decided in the second half of 2023 not to wait for the National Ordinance on Games of Chance (LOK), which came into force in December 2024.

Because the work needed specialist knowledge, the CGA says it brought in external parties and selected an externally managed portal, supported by dedicated CGA staff, intending to move to an internally managed portal later. It has hired 14 employees since 2024, mainly for licensing, supervision and enforcement. "Although external advisers supported the portal, CGA itself remained responsible for licensing and supervision," the release says.

A Temporary Portal, and No Launch Notice

The CGA says the internal system, digital seal and licence register were ready for security checks by independent specialists, while the client portal was still being adjusted before its own testing. The temporary portal was "scheduled to launch on Monday, 19 October 2026", with the register and seal. Closing the previous portal "does not invalidate existing licenses", it says.

On 20 October the CGA homepage still said it "will launch its new interim online gaming portal on October 19, 2026", and no notice confirming the launch had been published. The portal's address, which on 15 October redirected to the homepage, now serves a sign-in page for the "CGA Licensing Portal" that asks users to sign in with the Microsoft account of "the email address the Authority invited", or to redeem an invitation code.

The CGA's Own Timeline Is the Hardest Fact in the Release

By the regulator's own account, an outsider was inside its portal and database for about nine months before it knew. The release does not say how it found out. Wittmann has written that her request for comment reached the CGA at about 22:00 on 17 September, the date the CGA gives for its discovery, and that the hole she used was closed by about 22:30. If that is how the CGA learned of it, its own monitoring did not detect the intruder at all. That matters for a supervisor whose portal was also where licensees filed their incident reports. The Curaçao Online Gaming Association (COGA), which condemned the intrusion, also said a higher and more professional level of security should have been expected of the CGA and its provider, according to the Curaçao Chronicle.

Calling It a Crime Does Not Answer the Licensees' Question

The CGA may be right that the access was unlawful; by its own account and Wittmann's, it began under a false identity. But licence holders whose passports, ownership files and financial records may be in the archive want to know what was taken and whether they will be told, and the release says neither. In September the CGA promised to notify affected parties directly; this release says only that "the concerns of those affected must be heard and addressed". Takedown specialists can remove copies; they cannot recall what media partners have already reported. Civil action is uncertain too: a Berlin court, in preliminary proceedings brought by the Malta Gaming Authority, allowed Wittmann to keep using documents from that regulator for journalism, according to her account reported by the Curaçao Chronicle, though the full ruling is not public.

The Reform's Shortcut Is Now on the Record

The release's most useful passage is its explanation of why Curaçao did not wait for the LOK: commitments to the Netherlands, an approaching CFATF assessment, and a decision to move fast with outside expertise. It delivered volume. The register on 14 October listed 559 entries neither expired nor revoked, against 14 hires since 2024. But it also put the jurisdiction's most sensitive archive, the ownership files at the centre of the leak, on a system the regulator did not run itself. The invitation-only sign-in suggests open self-registration, the route the intruder used, has been closed. The test arrives with the LOK's second anniversary on 24 December, the date by which the CGA has said supplier registration must be working.

The CGA has now explained how it came to depend on an outside portal, and is building its own. Until it says what was taken and tells the people affected, the explanation will read as a defence rather than an account.