Curaçao regulator says its licensing portal was accessed for nine months under a false identity

The Curaçao Gaming Authority (CGA) has confirmed that an outsider had access to its online licensing portal for roughly nine months. In a follow-up statement dated 22 September 2026, the regulator said the access came through the customer-facing part of the portal, the side used by applicants and licensees, via an account registered in December 2025 under a false identity. It continued until it was identified and ended in September 2026.

According to the CGA, the account combined a variant of a real person's name with a company that exists in the Curaçao Chamber of Commerce registry. The regulator called the access "a serious breach under Curacao law" and said it will report it to the relevant authorities.

From “contained” to nine months

The CGA first disclosed the incident on 17 September 2026. That statement said the unauthorised access had been contained and its source identified, that its service provider had started a forensic investigation, and that no compromise of the authority's core technical infrastructure had been found. It gave no timeframe.

The follow-up came after the German security researcher Lilith Wittmann published her own account on 22 September, together with the Dutch investigative platform Follow the Money (FTM) and other European media partners. The CGA does not name her. It says the researcher's claims to have accessed the portal and extracted data about Curaçao operators and internal CGA documents are "consistent with its internal investigation".

Wittmann writes that she first logged in on 3 December 2025, and that the gap was closed about half an hour after she sent the regulator her questions at around 10 pm on 17 September, the day of its first statement. Those timings are her account; the CGA has not published its own.

What the leak contains, and what the CGA confirms

The regulator says the full extent of the material obtained has not yet been established, and that it "will not repeat figures it cannot verify".

The published reporting describes a large cache. FTM says Wittmann obtained tens of thousands of confidential documents, including licence applications, owners' names, the regulator's own assessments, passports, tax returns and financial information. According to FTM, the files identify about 800 owners of nearly 650 licensed gambling companies. The CGA has not confirmed those figures.

FTM also reports that licences were granted while questions about ownership or the source of funds were still open. The CGA did not dispute that to FTM. It pointed to a transition period in which companies get time to meet the requirements of Curaçao's 2024 gambling law step by step. In its 22 September statement, the regulator said it has followed "robust internal procedures" for due diligence since the reform began, and that conclusions should not be drawn from separate documents without the context of each application.

Security changes and next steps

Since 17 September, the CGA says, it has strengthened security in both the back office and the customer interface of the portal and installed software security upgrades. Licensed online operators have been told about changes they need to make on their side and urged to implement them as soon as possible.

Where the investigation finds that information about individuals, applicants, licensees or other stakeholders may have been affected, the CGA says it will notify those parties directly. It has promised further updates as the investigation progresses.

The breach has also reached local politics. The parliamentary faction MAN-PIN wants to amend Curaçao's national gaming ordinance and bring the online gaming system's infrastructure and data back to the island, Curaçao.nu reports. It has asked for a parliamentary debate on the ordinance to wait until the investigations into the CGA are finished.

What it means for players

The records described so far concern licence applicants, licensees and their owners. The CGA has not said that casino player accounts were affected, and the published reporting does not describe player data. For players, the impact is indirect: according to FTM, Curaçao-licensed companies run thousands of online gambling sites, and the leak adds to long-standing questions about how closely their owners are checked.

A Curaçao licence is not the same as a licence in your own country. Before you deposit, check who operates a casino and what its terms say. Our guide to the small print covers what to look for. 18+. If gambling stops being fun, see responsible play.