- Developing
Curaçao Gaming Authority Investigates Unauthorised Access to Licensing Portal
The Curaçao Gaming Authority has confirmed unauthorized access to its online licensing portal, saying the intrusion was contained and its source identified, while a forensic investigation continues and the full scope remains unestablished.
The Curaçao Gaming Authority (CGA) has confirmed that its online gaming licensing portal was accessed without authorization, and said the access has since been contained. In a statement issued September 17, 2026, the regulator said it and its service provider activated incident response procedures as soon as the intrusion was detected, and that a forensic investigation remains underway. A follow-up statement issued September 22 added further detail: the access ran from December 2025 to September 2026, entered through the portal's customer-facing side, and used an account registered under a false identity.
The CGA has distinguished between information established through its investigation and claims reported by third parties. It said the full extent of material obtained had not yet been established and that it would not repeat figures it could not verify.
What the CGA Confirmed
In its September 17 statement, the CGA said it had identified unauthorized access to its online gaming portal, and that the access had been contained and its source identified. The regulator said it and its service provider immediately activated incident response procedures, and the provider began a forensic investigation to determine what had happened.
At that point, the CGA said the investigation had not established the full scope of the incident, and it was still assessing whether — and which — information had been accessed, along with the potential consequences. Notably, the CGA said its investigation had not identified any compromise of its core technical infrastructure, though it cautioned that, given the sensitivity of the information it holds, it would be premature to draw conclusions about the incident's overall impact. As a precaution, the CGA said it had implemented additional monitoring and security measures.
The regulator said it would notify any individuals, applicants, licensees or other stakeholders directly if the investigation determined their information had been affected, in line with applicable legal and regulatory requirements.
September 22 Follow-Up
The CGA's second statement came five days later, after international media outlets published reporting based on material a German security researcher says she obtained from the portal. The CGA said this reporting was consistent with its own internal investigation, and used the follow-up to set out additional confirmed detail.
According to the CGA, access was obtained through the customer-facing part of the licensing portal, using an account that had been registered in December 2025 under a false identity. The regulator said whoever created the account used a variant of a real person's name, combined with an existing company registered with the Curaçao Chamber of Commerce. That access continued from December 2025 until September 2026, when it was identified and terminated.
The CGA described the incident as a serious breach under Curaçao law, called it unacceptable, and said it intends to report the matter to the relevant authorities. At the same time, the regulator repeated that the full extent of the material obtained has not yet been established, adding pointedly that it “will not repeat figures it cannot verify” and will state what was taken only once its investigation supports doing so.
What Remains Unknown
Several points that have driven headlines elsewhere have not been confirmed by the CGA itself. The regulator has not stated how many documents were accessed, how many operators or licensees may be affected, or whether beneficial ownership, financial, tax or anti-money-laundering information was exposed. It has also not named any specific licensee or operator as having been compromised.
International reporting — principally an investigation published by the Dutch outlet Follow the Money, working with the researcher and media partners including NRK, NDR, SVT and Jetzt — has offered far more specific figures, including claims that tens of thousands of documents were obtained and that the material identifies roughly 800 individuals connected to some 650 licensed companies. Those figures come from the researcher and the reporting consortium, not from the CGA, and the regulator's own statements do not confirm them. This article treats them as attributed third-party claims rather than established fact.
Security Response
Since the September 17 disclosure, the CGA says it has strengthened the security of its online portal, implementing changes in both the back-office system and the customer-facing interface, alongside software security upgrades. Online gaming operators have been informed of changes affecting their end of the system and urged to implement them as soon as possible.
The regulator has framed its response as a two-track effort: containing and hardening the technical environment while a forensic investigation continues to establish what, if anything, was taken and who may have been affected.
Why the Licensing Portal Matters
The CGA is Curaçao's regulator for land-based casinos, lotteries and charity gaming, and — under the island's National Ordinance on Games of Chance, known as the LOK — the regulator for online gaming as well. It also supervises the sector's compliance with anti-money-laundering and counter-terrorist-financing rules.
The licensing portal is the system through which online gaming operators and applicants submit and manage license applications and related documentation under Curaçao's 2024 online gaming reform, which moved the jurisdiction away from a legacy sub-licensing model toward direct CGA licensing. Because every company seeking or holding a Curaçao online gaming license interacts with this portal, an incident affecting it has drawn attention well beyond Curaçao itself.
Third-Party Reporting
Coverage from Follow the Money and its media partners has focused heavily on the ownership information the researcher says she obtained, framing the incident as an exposure of previously anonymous casino owners. The researcher, identified in that reporting as Berlin-based security researcher Lilith Wittmann, has also drawn a comparison to an earlier, similarly disclosed access to systems at the Malta Gaming Authority, over which she is currently in litigation.
None of the specific volume figures, ownership counts, or operator-level claims in that reporting have been independently verified by Level.casino, and the CGA's own statements do not confirm them. Where this reporting is referenced, it should be understood as the claims of the researcher and the reporting outlets involved — not as conclusions this publication or the CGA has reached.
What Happens Next
The CGA has said only that its investigation remains ongoing, that it will provide further information as that investigation progresses, and that it intends to report the incident to the relevant authorities. It has not given a timeline for when the scope of the incident will be fully established, nor has it said when or whether individually affected licensees or applicants will be notified — beyond its stated commitment to do so if and when the investigation determines their information was involved.
Timeline
- December 2025 — An account is registered on the CGA's customer-facing licensing portal under a false identity, according to the CGA's own account.
- Before September 17, 2026 — The CGA detects the unauthorized access and activates incident response procedures with its service provider.
- September 17, 2026 — The CGA publicly confirms unauthorized access to its online gaming portal, saying the access has been contained and its source identified.
- September 22, 2026 — The CGA issues a follow-up statement confirming the customer-facing entry point, the false-identity registration, the roughly nine-month duration, and describing security upgrades implemented since September 17. Around the same time, Follow the Money and partner outlets publish their investigation into the material the researcher says she obtained.
Bottom Line
The CGA has confirmed a real security incident: unauthorized access to its online licensing portal, sustained for roughly nine months via a fraudulently registered account, which the regulator has since contained and is treating as a serious breach under Curaçao law. What the CGA has not confirmed — the volume of material obtained, which licensees or applicants may be affected, and whether sensitive ownership or financial information was exposed — remains under investigation. Readers should treat the more specific figures circulating in international media as claims from the researcher and reporting outlets involved, pending the CGA's own findings.
| Fact box | |
|---|---|
| Incident | Unauthorized access to CGA online gaming portal |
| Authority | Curaçao Gaming Authority |
| Initial CGA statement | 17 September 2026 |
| Follow-up | 22 September 2026 |
| Current status | Investigation ongoing |
| Scope | Not yet fully established |
Reporting & Methodology
This article is based primarily on the Curaçao Gaming Authority's own statements dated 17 and 22 September 2026, published on the regulator's official website, supplemented by independently reviewed secondary reporting, including Follow the Money's investigation and industry trade press, for clearly attributed context on claims the CGA itself has not confirmed.