Curaçao CGA Portal Leak: What Operators Should Do Now

If you hold a Curaçao licence or applied for one, assume that everything you uploaded to the Curaçao Gaming Authority’s licensing portal before September 2026 has been read by an outsider and may now be public. The CGA confirms that an account registered under a false identity sat inside the portal from December 2025 until September 2026. Nothing the CGA has said touches the validity of your licence. The people named in your file are the ones exposed, and the work this week is protecting them.

What happened

The CGA published its first statement on 17 September 2026, saying it had found unauthorised access to its online gaming portal, contained it and identified the source. Five days later Follow the Money (FTM) and partner outlets NRK, NDR, Jetzt and SVT began publishing Casino Secrets, a joint investigation built on files taken from that portal by Berlin-based researcher Lilith Wittmann.

The CGA’s follow-up of 22 September confirmed the method. The account was registered in December 2025 using a variant of a real person’s name combined with a company that exists in the Curaçao Chamber of Commerce registry. FTM reports that she used the name of a Dutch trust office manager known to the regulator with her own Gmail address, was granted access within days, and then uploaded software that let her reach every document stored in the system.

The CGA calls it a serious breach under Curaçao law and says it will report it to the relevant authorities. It said on 17 September that it had not, at that stage, found any compromise of its core technical infrastructure. FTM notes that Wittmann previously hacked the Malta Gaming Authority. On 25 September Wittmann said a Berlin court had allowed her to keep using the Malta documents while barring further access to MGA systems (Casino.org, Next.io). Only Wittmann’s screenshot of the judgment is public, and the MGA says it is still analysing the decision.

What leaked

FTM describes tens of thousands of confidential documents, including owners’ names, licence applications and the regulator’s own assessments, with passports, tax returns and sensitive financial information in the cache. Its analysis covers the 646 organisations that held a licence as of December 2025 and verified 897 ultimate beneficial owner records relating to 767 individuals. Trade press, including Casino.org, reports that more than 40,000 documents were published in a searchable archive, with source-of-wealth and funding documents among them. Casino.org reported that the archive’s original website was knocked offline on 25 September and was back online under a new domain within hours.

The CGA has not confirmed any of these figures. Its statement says the full extent of the material “has not yet been established” and that it will not repeat numbers it cannot verify. We are not linking to the archive and we have not searched it.

The trust sector has been told more than the public statements say. According to the United Trust Companies association (UTC), as reported by Curaçao.nu and the Curaçao Chronicle, the CGA told corporate service providers it assumes the whole portal database was accessed and searched between December 2025 and September 2026, asked them to notify affected individuals, and warned of identity fraud where identity documents were made public. The same reporting notes that staff of two outside firms, Random Consulting in Malta and HSJ Consult in Cyprus, also held portal accounts because they carry out due diligence and suitability work on applications. UTC has not suggested either firm had unnecessary access to files. Random Consulting’s agreement with the CGA is already the subject of the governance probe we covered in August.

What operators should do this week

Items one and two follow what the CGA and UTC have said. The rest is our advice, ordinary incident practice applied to this leak.

1. Apply the portal changes the CGA sent you. The CGA says it informed operators of changes needed at their end and urged them to act as soon as possible. If nobody in your team can point to that message and confirm it was done, find out today.
2. Tell every person named in your file. UBOs, directors, the local managing director and key persons should hear from you first, with a plain list of which of their documents were submitted. If a trust office holds that relationship, confirm it has done the notification the CGA asked for.
3. Ask your corporate service provider which portal accounts exist for your entity. The intruder got in by posing as a trust office manager. Know exactly who holds a login in your company’s name, remove anyone who no longer needs one, and change passwords on those accounts and anywhere they were reused.
4. Verify any message about the leak before you act on it. Expect emails and calls that cite real details from your application. Confirm anything claiming to be from the CGA through the contacts on cga.cw (info@cga.cw, +599 9 737 2299) and never through a link or number in the message itself.
5. Brief finance and payments staff. Requests to change bank details, “re-verify” a director or pay a fee to a new account are the classic follow-on. Require a call-back to a known number for any change of payment instructions.
6. Put the notification question to your own data-protection counsel. Whether your group has its own duty to notify anyone depends on where it is established and what it holds. The CGA says it will notify affected parties directly where its investigation finds their information may have been affected. That does not answer whether you have separate obligations.

If you are unsure what your file contained or who holds portal access for your entity, our Curaçao gaming licence team can go through it with you.

Update, 12 October 2026. The portal is not coming back. On 7 October the CGA announced that the current online gaming portal “will not be returned to service” and that it is moving to a new regulatory platform, with licensing and supervision continuing through interim arrangements. It repeated that existing licences stay valid, and its notice of 2 October postponed deadlines for documents that had to be filed through the portal until a replacement is available. The CGA also said the availability of the digital seal will be affected and that it will introduce another way for operators to show that a domain is licensed. Until it does, the register PDFs on cga.cw are the only public check; our Curaçao licence check guide walks through them.

How it fits the LOK timetable

Neither of the September statements paused applications or moved a date. The CGA’s notice of 2 October has since postponed deadlines for anything that has to be submitted through the portal, so check which of the dates below depend on a portal filing. The terms-and-conditions deadline of 8 October 2026 was not changed by those statements, and nor was enforcement of local staffing from 1 April 2027. The CGA fee schedule is unchanged too.

What we expect to change is scrutiny. FTM’s central finding is that licences were granted while ownership questions were unanswered and applicants had not supplied important information. Asked by FTM, the CGA did not dispute that some licences were granted with ownership questions still open. It told FTM the sector was in a transition period in which the requirements of the 2024 law are being introduced step by step, and that its guiding principle was not to “immediately refuse a licence or terminate existing activities whenever there is a question or uncertainty”. Its 22 September statement says open points were followed up and that it is not prudent to judge its licensing process from separate documents without the context of each application. If your approval listed anything outstanding, close it now: a regulator under this much public pressure is likely to chase open conditions harder. Our LOK and CGA guide sets out what the regime expects of a licence holder.

Some operators will reconsider Curaçao as a sole credential. That is a fair question on its own merits, and our Curaçao vs Anjouan comparison sets out the cost and substance trade-offs. A data leak at the regulator is not by itself a reason to abandon a licence you have already paid for.

The CGA says it will say what was taken once its investigation supports it, and we will update this page when it does. If you want a second pair of eyes on what your file contained or on your Curaçao position, book a free consultation or see our Curaçao gaming licence service.

Iryna H.

Gaming Licensing at Vantegris

Iryna H. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Full profile Book a free consultation

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.