The Curacao Gaming Authority data breach has moved from investigation to legal action. In a press release dated 19 October 2026 the CGA said it had filed complaints with authorities in Curacao, Germany and the Netherlands. It also hired specialist companies to remove the leaked licensee information from the internet. An independent technical investigation is under way and the regulator is weighing civil action. Curacao licences stay valid, and every licence can still be checked on its certificate page.
What the CGA press release of 19 October says
Curacao’s regulator confirmed that a digital security researcher from Germany got into its online licensing portal in December 2025. The authority found the intrusion on 17 September 2026. By then the person had accessed and published data and confidential information that belonged to licence holders. The CGA calls it criminal conduct and lists four steps.
- Complaints and reports to authorities in Curacao, Germany and the Netherlands.
- Specialist companies hired to remove the information available on the internet.
- An independent technical investigation into the impact of the attack.
- Civil legal action, which the regulator is still considering.
The release does not name the takedown companies. It gives no count of documents either. In September the authority wrote that it would only state what was taken once the investigation supports it.
Timeline of the CGA portal breach
| Date | What the Curacao Gaming Authority said or did |
|---|---|
| December 2025 | An account registered under a false identity gains access to the customer side of the licensing portal |
| 17 September 2026 | The CGA discovers the access and announces an investigation |
| 22 September 2026 | The regulator confirms the access ran from December 2025 to September 2026 |
| Early October 2026 | The portal is offline and filing deadlines are postponed |
| 7 October 2026 | The CGA says the portal will not return and ends the service arrangements behind it |
| 19 October 2026 | Complaints in three countries, takedown firms hired, temporary portal scheduled for that day |
Why the old licensing portal is gone for good
An external company ran the portal and its database. The CGA, then still called the Gaming Control Board, chose that setup for the reform of online gambling licensing that began in 2023 on the instructions of the Minister of Finance. The plan was to bring the portal in house later. Since 2024 the authority has hired 14 employees, mostly for licensing, supervision and enforcement. On 7 October it said the current portal would not be returned to service. Twelve days later it described this as ending its use of the provider’s regulatory services. The provider is not named in either notice.
A temporary portal was scheduled to open on Monday 19 October 2026. The CGA wrote that its internal system, digital seal and licence register were ready for independent security checks. The client portal still needed changes before testing. On 22 October portal.cga.cw showed a sign-in page for the CGA Licensing Portal, open to applicants and licensees through a Microsoft account or an invitation code.
What the breach means for a Curacao licence check
Existing Curacao licences remain in force. The regulator wrote that closing the old portal does not invalidate them, and licensees must keep meeting their obligations. The certificate pages still answer. On 22 October cert.cga.cw/token?id=838 showed licence OGL/2024/1507/0838 of Liquid Entertainment N.V. as Active, with its approved domains.
The seal is the weak point for now. On 7 October the CGA warned that the availability of the current digital seal would be affected. It promised another way for operators to show that a domain holds a licence. The public search page at cert.cga.cw/search has returned a page-not-found error since 30 September.
How to check a Curacao casino this week
- Find the licence number in the casino footer or terms. It looks like OGL/2024/1507/0838.
- Open cert.cga.cw/token?id= followed by the last part of that number, here id=838.
- Confirm the licence status reads Active and that the exact domain you use is in the list of approved domains.
- Compare the company on the certificate with the operator named in the casino terms.
- Search the brand on our Curacao license check page. It reads the same certificate pages and also shows revoked and withdrawn licences.
Our earlier explainer on the Curacao Gaming Authority leak covers what a Curacao permit proves and what it never did. We do not use the leaked documents. Everything on this page comes from the regulator’s own notices and its live certificate pages.