Curaçao Retires Online Gaming Portal Permanently Following High-Profile Data Breach

The Curaçao Gaming Authority (CGA) has confirmed that its online gaming portal will not return to service, closing a chapter on one of the more consequential cybersecurity incidents to affect a gambling regulator in recent years. In a notice dated 7 October, the regulator stated that the portal “will not be returned to service” and that the jurisdiction will transition to a new regulatory platform.

The portal, which had been operational since September 2023, served as the primary gateway for licensing activity under Curaçao’s reformed regulatory framework, handling both B2C and B2B licence applications. The decision to retire it permanently follows a high-profile data breach attributed to German security researcher Lilith Wittmann.

The CGA subsequently disclosed that unauthorized access to the licensing portal had persisted for approximately nine months before being addressed, a revelation that prompted an investigation and a series of security measures.

Wittmann is a familiar figure within the sector. Earlier in 2026, she claimed responsibility for a breach of the Malta Gaming Authority’s systems, describing her actions as a justified necessity and asserting that the accessed data pointed to broader concerns within the industry. She has also previously identified vulnerabilities in the online casino platforms of a major German gambling group. Regulators, for their part, have consistently characterized such intrusions as unacceptable, regardless of the intent behind them.

Operational Implications for Licensees

The portal currently redirects visitors to the main CGA website, where a notice confirms the platform is offline pending the transition to a replacement system. In practical terms, the shutdown leaves several processes in flux:

• Application timelines: Filing deadlines for new licences are now subject to revision, creating uncertainty for operators preparing submissions under the National Ordinance for Games of Chance (LOK).
• Digital licensing instruments: The status of digital licence seals and related verification tools requires clarification as the regulator migrates to a new platform.
• Licence validity: The CGA has indicated that the breach affected the portal infrastructure rather than the underlying licences. Existing licences held by operators remain valid.

The CGA has also separately moved to end its contract with a Maltese adviser, a development reported in the same period as the portal shutdown and one that adds to the broader reshaping of the jurisdiction’s regulatory apparatus.

A Jurisdiction Under Scrutiny

The incident arrives at a sensitive moment for Curaçao. The island has spent recent years attempting to overhaul its reputation as a jurisdiction associated with light-touch oversight, introducing the LOK, centralizing licensing under the CGA, and issuing detailed guidance on matters ranging from crypto gambling to wind-down procedures for exiting licensees. Those reforms were designed, in part, to improve the credibility of the Curaçao licence among international regulators and payment partners.

A nine-month undetected intrusion into the licensing portal undermines that narrative to a degree, and the regulator’s decision to abandon the platform altogether rather than restore it suggests an acknowledgment that remediation required more than incremental fixes.

At the same time, the episode raises questions about the balance between transparency and security in gambling regulation. Security researchers argue that exposing systemic weaknesses serves the public interest; regulators contend that unauthorized access – however well-intentioned – compromises data integrity and regulatory operations.