Curacao regulator replaces its licensing portal after a data breach
The Curacao Gaming Authority said on 19 October 2026 that someone gained unauthorised access to its online gambling licensing portal and published confidential licence holder information. It is dropping the portal and its external provider and moving to a temporary system, while existing licences stay valid.
Many offshore casinos that accept South African players hold Curacao licences, so the health of that regulator matters to the market you play in. This story is about the regulator's own IT security, not about any player account, and the authority has not said that player data was taken. It is still a reminder that a licence badge is only as useful as the oversight behind it. No South African operator holds a licence for remote casino games, so a Curacao licence is not a South African approval. Check any operator's licence yourself and read our methodology before trusting a site.
What the regulator announced
The Curacao Gaming Authority (CGA) published a statement on 19 October 2026 about a data breach at its online gambling licensing portal. It says it discovered on 17 September that a security researcher based in Germany had got into the portal without permission and published data and confidential information belonging to licence holders.
The authority puts the unauthorised access between December 2025 and September 2026. The portal and its database were run by an external company, and the CGA has now decided to stop using that portal and to end its use of the provider's regulatory services for good.
What happens next
The CGA said a temporary replacement portal was due to open on Monday 19 October 2026, with a licence register and a digital seal that is meant to show a site holds a CGA licence. It is also preparing to build and run a new portal itself.
- Complaints have been filed in Curacao, Germany and the Netherlands.
- Specialist firms have been hired to remove the leaked material from the internet.
- An independent forensic investigation is under way.
- The CGA says it is considering civil legal action.
It also stressed that closing the old portal does not cancel any existing licence, and licensed companies must keep meeting their obligations.
Why it matters to South African players
Curacao reformed its system under a law that came into force in December 2024, moving away from master licences and sublicences towards direct supervision of operators. The CGA says it has hired 14 staff since the reform began. A breach of this kind tests how far that reform has got.
For you, the practical points are modest. The announcement does not say player data was exposed, and we have not seen evidence that it was. If you use an offshore casino, keep your own passwords unique and be wary of unexpected emails that mention your account. Our FICA verification guide covers what identity documents you should expect to hand over, and to whom.
What to watch
- The findings of the independent forensic investigation.
- Whether the temporary portal and licence register work as promised.
- Any statement on which licence holders were affected.