Curaçao's Regulator Abandons Its Breached Licensing Portal and Says Its Licence Seal Is Affected

The Curaçao Gaming Authority will not bring back the portal a hacker used for nine months, and is ending the service arrangements behind it. The seal that lets anyone check a Curaçao-licensed domain is affected too, and its replacement has not yet been published.

• The Curaçao Gaming Authority (CGA) said on 7 October that its online gaming portal "will not be returned to service", and that discontinuing it also concludes the service arrangements that supported the platform
• Existing licences remain valid, and licensing, compliance and supervision continue "through alternative arrangements" while an interim solution is put in place, with details targeted for no later than 9 October 2026, according to the regulator
• The CGA said the availability of its current digital seal "will be affected" and that it will shortly introduce another way for operators to show that a domain is licensed by the CGA
• The notice says the CGA's response to the unauthorised access to its licensing portal continues, "including containment of the data leak", wording that goes well beyond its first statement in September
• The portal was already offline by 2 October, when the CGA told applicants not to email portal submissions and postponed portal filing deadlines until further notice

The Portal Is Gone, and the Arrangements Behind It End With It

The Curaçao Gaming Authority (CGA) said in a notice dated 7 October that its current online gaming portal will not be returned to service, and that "the discontinuation of the portal also entails the conclusion of the associated service arrangements supporting the platform". It did not name the service provider, say why the portal will not return, or describe a permanent replacement.

According to the notice, existing licences remain valid, operators' obligations are unchanged, and licensing, compliance and supervision "will continue through alternative arrangements" while an interim solution is implemented. Further information is "currently targeted for no later than October 9, 2026". Because "the availability of the current digital seal will be affected", the CGA said it will "shortly introduce an alternative mechanism" through which operators can show that a domain is licensed by the CGA. It gave no date.

The portal was already down. A CGA notice published on 2 October said it was offline, asked applicants not to send portal material to its egl-applications email address because it could not be processed through other channels, and postponed portal filing deadlines until the portal returned. On 8 October the portal's address, portal.cga.cw, redirected to the CGA homepage, which carries a notice that the portal is offline. The certificate site at cert.cga.cw, where the seal leads, was still loading that day.

From "Whether" Information Was Accessed to a "Data Leak"

The notice closes on the breach: the CGA "continues its efforts in response to the unauthorized access incident, including containment of the data leak". When it first disclosed the access on 17 September, it said it was assessing "whether and which information was accessed". On 22 September it said the intruder had used an applicant account registered under a false identity in December 2025, and that it would not repeat figures it could not verify.

A statement dated 25 September, on why the CGA would skip SBC Summit Lisbon 2026, went further: the regulator said it had reported "unlawfully gathered information from its online portal" to domestic and international authorities, was evaluating legal action against the German security researcher, and was monitoring the publication of its leaked data online in order to have it removed. The hacker Lilith Wittmann has said she spent nine months inside the regulator's systems.

The notice does not say whose service arrangements are ending. Random Consulting Limited, a Malta-based company associated with gaming consultant Mario Galea, said in a statement published by the Curaçao Chronicle that it designed, developed, hosts and maintains the licensing portal, and has also provided licence and domain monitoring for the CGA. That statement rebutted payment figures given by Finance Minister Charles Cooper, who has said the government will investigate, according to the same newspaper. Neither the CGA nor Random Consulting has said publicly whether that engagement is the one now concluding.

Losing the Seal Matters More Outside Curaçao Than Inside It

Under the CGA's certification policy, a B2C operator's Certificate of Operation seal must click through to cert.cga.cw and show the exact domain being visited, the licensed operator and its licence status, and a certificate showing a different domain marks the site as unauthorised. That domain-level check is what payment providers, affiliates and app and advertising platforms reviewing Curaçao-licensed brands are most likely to rely on, alongside players. Until a replacement is published, each of them must decide whether to trust a seal the regulator itself has qualified or ask operators for paper evidence instead. The policy anticipates sites borrowing other operators' certificates, and an uncertain seal makes that easier. How short "shortly" proves to be will decide whether this is an inconvenience or a payments problem.

"Data Leak" Is the Regulator's Own Phrase Now

In three weeks the CGA's language has moved from not knowing whether information was accessed to containing a leak, and the phrase now sits in a notice to the whole licensed market. It has still not published what was taken, or whether the parties it promised on 17 September to notify directly have been told. For licensees whose ownership and identity files may be in the leaked material, containment means takedown requests, which cannot undo publication. The CGA has disclosed more, and faster, than many regulators do after a breach. But retiring the platform, rather than restoring it after the security upgrades it described in September, suggests it concluded the system could not be returned to service with confidence.

Applicants and Suppliers Are Waiting on 9 October

The portal was the single channel for applications and periodic, incident and change reports under the National Ordinance on Games of Chance (LOK), and email is ruled out, so anyone mid-application has no revised timetable. Suppliers are most exposed: in June the CGA urged unlicensed local suppliers to apply through the portal by 1 September and said registration for local and foreign suppliers was expected to open in October 2026, according to Asia Gaming Brief, and its second-quarter bulletin says the registration function must be operational no later than 24 December 2026. Licensees may not engage unregistered suppliers under Article 5.16(4) of the LOK, as Asia Gaming Brief reported, so the interim arrangement has to carry supplier registration, or the CGA will have to say what happens to that deadline.

Curaçao has chosen to replace its licensing system rather than repair it, a defensible answer to a nine-month intrusion. Whether it was the right one will be judged by what arrives on 9 October and how soon a Curaçao licence can be checked again.