Curaçao Gaming Authority Investigates Online Portal Hack

The compromised portal handles licensing documentation for business-to-consumer (B2C) operators and business-to-business (B2B) suppliers under Curaçao's new gambling law, the Landsverordening op de Kansspelen (LOK).

The Curaçao Gaming Authority (CGA) said it had identified the source of the unauthorised access and stopped further access. The regulator did not name the source or explain how the incident occurred.

After detecting the issue, the CGA and its service provider activated their incident response procedures. The service provider then began a forensic investigation to establish what happened and assess the possible impact.

Context of the Regulatory Overhaul

For years, Curaçao used a master-licence system for online gaming. Four companies held licences from the government and issued sublicences to individual operators. As a result, the regulator had no direct licensing relationship with most of the casinos operating from Curaçao.

The cyberattack occurred just months after the CGA published its highly anticipated Information Security Control Requirements framework in May 2026.

The online portal became a central part of the new system. Operators must use it to apply for a licence, while licensees submit periodic, incident and change reports through the same service.

What Happens Next

The CGA said it is working with the relevant authorities and will decide whether further action is necessary once investigators establish the facts.

No timetable has been given for the investigation. The regulator plans to issue further updates when it has confirmed more information.

For now, the confirmed facts remain limited: the access has been contained, its source has been identified, and a forensic investigation is still in progress.

The CGA incident follows a recent breach of the Malta Gaming Authority, which led to the release of documents concerning the owners of 1xBet, Stake and Blaze.