Curaçao Gaming Authority Confirms Portal Breach

The Curaçao Gaming Authority (CGA) has confirmed unauthorized access to its online gaming portal, the regulator said in a statement dated September 17. The access has been contained and its source identified, but the CGA says it is still assessing “whether and which information was accessed, as well as the potential consequences arising from such access.”

That matters well beyond the island. The operators behind Stake and Shuffle are both Curaçao companies licensed there, and on September 14 The Irish Times described Curaçao as “a small Caribbean island state and haven for many offshore gambling companies.”

What the CGA Has Confirmed

The statement is short and careful. When the breach was detected, the CGA and its service provider “immediately activated their incident response procedures,” and the provider started a forensic investigation. So far, the CGA says, that investigation “has not identified any compromise of the Authority’s core technical infrastructure.”

It isn’t calling the all-clear, though. “Given the nature of the information held by CGA, it would be premature to draw conclusions regarding the overall impact of the incident,” the regulator said. It has added monitoring and security measures while the work continues.

Who Gets a Call

If the investigation finds that information about “individuals, applicants, licensees, or other stakeholders” was affected, the CGA says those parties will be notified directly. Players aren’t mentioned anywhere in the statement.

The regulator closed the door on questions for now: “As the matter remains subject to investigation and engagement with the relevant authorities, no further details can be disclosed at this time.”

What Sits Inside the Portal

The CGA’s own website links its “Online gaming portal” to its License Management Portal, and that portal explains what it’s for. Operators use it to apply for an online gaming license, suppliers use it to apply for a supplier license, and licensees file their periodic, incident and change reports through it.

The paperwork is personal. Applicants submit a Personal History Disclosure form signed by a qualifying person at the company. The CGA says it will refuse a license if “the identity, existence, and involvement of all ultimate beneficial owners” can’t be verified. Under the National Ordinance on Games of Chance, known as the LOK, a licensee also has to be a Curaçao company managed by at least one managing director who lives on the island.

A Big Target by Design

Put together, that’s a file on who owns and runs the island’s licensed operators, big crypto casino brands among them. The CGA hasn’t said which part of the portal was reached, and it may not know yet. The breach is a concern either way for owners who expected those documents to stay with the regulator.

Curaçao Is Still Rebuilding Its Rules

The timing isn’t great. The LOK came into effect on December 24, 2024, replacing the old offshore licensing system, and the Gaming Control Board has been renamed the Curaçao Gaming Authority under it. Existing licenses under the old law were set to convert automatically into provisional licenses under the new one. Shuffle’s website still cites a license from the Curaçao Gaming Control Board, a reminder of how recent the switch is.

The CGA isn’t the only gambling regulator to deal with this in 2026. On March 20, the Malta Gaming Authority said it was aware of public statements by an individual claiming responsibility for unauthorized access to one of its systems. The MGA called the allegations made in that context “unsubstantiated.”

Not a Complaints Desk

For players, the CGA was never the safety net some assume. Its own website says it “does not handle individual complaints against gaming providers” and that it “cannot order gaming operators to compensate players.” What it does control is who gets a license, and that process runs through the portal that was breached.

The CGA says it will contact affected parties directly once it knows who they are. Until then, all it has confirmed is that someone got in.