Curaçao's Regulator Found Unauthorised Access to Its Licensing Portal

The Curaçao Gaming Authority says the access has been contained and its source identified, and that it has found no compromise of core infrastructure, but it has not yet established what information was reached. The portal is the single channel for every licence application, supplier filing and incident report under the LOK.

• The Curaçao Gaming Authority said on 17 September that it had identified unauthorised access to its online gaming portal, that the access has been contained and its source identified, and that its service provider has begun a forensic investigation
• "While the unauthorized access has been contained, the investigation remains ongoing and has not yet established the full scope of the incident," the regulator said, adding that it is assessing "whether and which information was accessed, as well as the potential consequences arising from such access"
• At this stage the investigation has not identified any compromise of the authority's core technical infrastructure, the CGA said, while noting that given the nature of the information it holds it would be premature to draw conclusions about the overall impact
• The portal is the single channel through which operators apply for online gaming licences, suppliers apply for supplier licences, and licensees file periodic, incident and change reports under the National Ordinance on Games of Chance (LOK), in force since 24 December 2024
• Additional monitoring and security measures are in place, and the CGA says it will notify individuals, applicants, licensees or other stakeholders directly if the investigation finds their information was affected

The Filing System for a Whole Licensing Regime Was Reached by Someone Who Should Not Have Been There

Curaçao's gambling regulator has disclosed that someone gained unauthorised access to the portal through which its entire licensing regime operates. In a statement dated 17 September, reported by European Gaming, the Curaçao Gaming Authority (CGA) said it had identified the access, that it and its service provider activated incident response procedures as soon as it was detected, and that the provider has since begun a forensic investigation. The access has been contained and its source identified.

What the CGA has not said is what was taken. "While the unauthorized access has been contained, the investigation remains ongoing and has not yet established the full scope of the incident," the statement reads. "The CGA is currently assessing whether and which information was accessed, as well as the potential consequences arising from such access." The regulator said the investigation has not so far identified any compromise of its core technical infrastructure, but added that given the nature of the information it holds, it would be premature to draw conclusions about the overall impact.

The portal's role explains the caution. Under the National Ordinance on Games of Chance, the LOK, which came into force on 24 December 2024 and converted the former Gaming Control Board into the CGA, the portal is the single channel for online gaming regulation on the island. Operators apply for licences through it, suppliers apply for supplier licences through it, and licensees file their periodic, incident and change reports there. The predecessor board reopened the portal for applications in July 2024 and has directed applicants to file documentation through it rather than by email ever since.

The CGA said it is treating the matter with the utmost seriousness, has put additional monitoring and security measures in place as a precaution, and is working to establish all relevant facts, with further action to follow if the findings warrant it. Where the investigation determines that information relating to individuals, applicants, licensees or other stakeholders may have been affected, those parties will be notified directly and in accordance with applicable legal and regulatory requirements.

A Licensing Portal Holds the One Dataset an Offshore Operator Most Wants Kept Private

Applications under the LOK typically carry ultimate beneficial ownership, source-of-funds documentation, directors' identity papers, corporate structures and compliance histories, for operators whose business model often depends on not being publicly associated with a given brand or shareholder. That combination is more valuable to a competitor, a journalist or an extortionist than most operator databases, and it sits in one place by regulatory design. The CGA's statement is careful to distinguish the portal from its core infrastructure, which matters technically and not at all to a licensee wondering whether its ownership file was copied.

Curaçao Is Rebuilding Its Reputation on This Regime, and Disclosure Is Part of It

The LOK exists because the old Curaçao master-licence system was treated across Europe as a byword for unsupervised gambling, and the whole point of the new regime is that the CGA knows who its licensees are and can prove it. Publishing an incident five days after identifying it, with what is known and what is not clearly separated, is the behaviour of a regulator that understands it is being judged. The test is what follows: whether the forensic report is published, whether affected parties are told promptly, and whether the answer to "what was accessed" ever arrives. Regulators that go quiet after an initial statement teach their licensees to do the same.

Every Regulator Now Holds a Target and Few Publish Their Controls

Gambling authorities have spent a decade requiring operators to demonstrate information security, penetration testing and breach notification, and comparatively little time demonstrating their own. The CGA's portal is run with a service provider, which is the normal arrangement and the normal weak point, and the incident will prompt questions in other jurisdictions about who holds the licensing archive, where it sits and what the notification duty is when the regulator is the one breached. Malta, the UK and the US states all run equivalent systems, and what any of them would publish in this situation is untested.

Curaçao has told its licensees that someone was inside the system holding their files and that it does not yet know what they saw. The next statement is the one that matters.