Curaçao Regulator Closes Licensing Portal After Hack

The Curaçao Gambling Authority is closing the online portal it used for licensing after a data breach, a move that matters to anyone who plays at crypto casinos, because Curaçao is the most common licence among them. Our crypto casino guide explains why licence checks matter, and this report covers what has been confirmed so far, what is still claimed, and what players should and should not conclude.

What happened

On 17 September 2026 the Curaçao Gambling Authority (CGA) reported unauthorised access to its online gaming portal and said the incident had been contained and its source identified. A few days later, Berlin-based security researcher Lilith Wittmann claimed responsibility. Gambling News, in a report dated 12 October 2026, said more than 40,000 documents were publicly released and that the CGA had since announced it would close the portal and end the related service arrangements behind it.

The CGA’s service provider started incident response procedures and a forensic investigation. At the time of the 12 October report, the findings had not been published.

What is claimed about the data

According to the report, Wittmann allegedly accessed ownership declarations, licence applications, regulatory assessments and tax documents. The report says the material reportedly exposed details about companies whose ownership is often hard to confirm in public registers. The figure of 40,000 documents and the description of the contents come from that report and from the researcher’s own claim; we have not independently verified them, and we do not name or characterise any individual or company named in the leaked files.

What the regulator says

The CGA says it is phasing out the existing platform while keeping its regulatory functions running without interruption. It acknowledged that the transition may be difficult for operators and thanked them for their cooperation. Licensing, compliance and supervisory work will continue under alternative arrangements until an interim solution is in place. Importantly, the closure does not affect the validity of existing licences, and licensed operators’ obligations are unchanged.

As of the 12 October report the regulator had not disclosed the interim solution, although it had been expected to announce interim arrangements by 9 October. A later headline on the same site refers to a temporary portal, but we have not confirmed what it covers.

What it means for players

Three practical points follow. First, a valid Curaçao licence is not cancelled by this event. Second, a licence number in a casino footer is only a starting point; players should check it against the regulator’s own channels, and the regulator’s verification process is itself in transition. Third, when ownership documents leak, the risk shifts to the people and companies named in them, so operators and players alike should expect phishing attempts that use real-looking licence or application details. Treat unexpected emails about licences, verification or payouts with caution.

It also underlines a structural issue for crypto casinos: oversight in several offshore jurisdictions depends on a small number of systems, and a single outage can slow verification for weeks. Our explainer on whether crypto gambling is legal in Thailand shows how a licence abroad does not make play legal in a player’s home country. The authority’s own notices are at gamingcuracao.com.

What we do not know

We do not know the cause of the breach, how many people are identifiable from the documents, what the interim licensing process will look like, or how long it will take. Until the CGA publishes those details, treat any claim about specific companies in the leak as unconfirmed.

When you check a casino licence before depositing, where do you look it up?

Frequently Asked Questions

Published with the iGaming community in mind. For guest posts and niche-edit backlinks see iGaming Backlink; for iGaming SEO see Mediardx.