Curaçao’s online gambling regulator faces the task of maintaining licensing and oversight without the digital platform that supported its recent sector reforms. The Curaçao Gaming Authority (CGA) has confirmed that its online gaming portal will not return, following a data breach involving more than 40,000 documents.
The decision, announced on October 7, 2026, also ends the service arrangements connected to the platform. The CGA says its regulatory work will continue through alternative arrangements while it prepares an interim solution for handling licensing and other regulatory matters.
For operators, the immediate position remains unchanged: existing licences are valid, and all regulatory obligations continue to apply.
Operators Await Details on Regulatory Processes
The portal had been active since September 2023 and played a role in implementing Curaçao’s online gaming reforms from 2024. Its closure leaves the CGA needing alternative procedures for licensing, compliance and supervision.
The authority had indicated that it would provide further information no later than October 9, 2026. The interim arrangements are intended to keep regulatory matters moving while a replacement solution is developed.
The CGA described the change as necessary to preserve its functions while moving away from the current platform and related services.
Operators must also prepare for a change in how they demonstrate their licensing status online. The existing digital seal system has been affected by the shutdown, and the regulator says it will introduce another way to verify that a domain is licensed by the CGA. Details of the replacement mechanism have not yet been provided.
Document Leak Behind the Decision
The shutdown follows an unauthorised access incident that came to wider attention in September. Hacker Lilith Wittmann publicly released more than 40,000 documents obtained from the portal. The material had been uploaded to the platform after unauthorized access the previous year.
The CGA says its response remains ongoing, with efforts focused on containing the leak and safeguarding its regulatory functions and information assets.
“The CGA also continues its efforts in response to the unauthorised access incident, including containment of the data leak, and remains focused on protecting the integrity of its regulatory functions and information assets.”
The end of the portal’s associated service arrangements has also drawn attention to the parties involved in operating the platform. Reporting linked the arrangements to Random Consulting, a company associated with former Malta Gaming Authority executive Mario Galea. The CGA’s announcement did not provide specific contractual details or name individual providers.
Licensing Continues During the Transition
The regulator has acknowledged that the changes may create difficulties for operators while new procedures are put in place. It has asked the industry to cooperate and said it will issue further updates as more information becomes available.
“We recognise that this transition may create challenges for operators and appreciate their cooperation and understanding during this period. Further updates will be provided as additional information becomes available.”
The next practical steps for operators depend on the CGA’s guidance on regulatory processing and its replacement domain-verification mechanism. Until then, existing licences and compliance requirements remain in force.