Key Points
- After months of uncertainty, the regulator is now working with a temporary licensing system that launched on 19 Oct, following the scrapping of the original set-up that got hacked.
- We’ve seen reports that over 40,000 documents were leaked, but the regulator still can’t bring itself to confirm the figure.
- One thing we do know is that licences were handed out with unclear ownership status still intact and the CGA hasn’t disputed that.
Finally, A Temporary Fix After Weeks without the System
It’s been weeks now since Curaçaos gambling regulator has not had the use of its main system, and Monday 19th October was the day that was meant to put an end to that.
In a statement the Curaçao Gaming Authority said that its temporary portal was going live on the 19th, a makeshift solution to handle licence applications and supervision work until the regulator can get round to building its own system and managing that properly.
Some trade titles did report that the portal went live on the day, but the CGA was a bit more cautious. They said its launch was only scheduled for the 19th, pretty clear that some parts of the new system are still not quite built yet.
Particularly important is the digital seal & signature, the seal that proves a website is officially licensed by the CGA. Until that seal and register are sorted, it’s going to be a lot harder for people to check if a site has a Curaçao licence. And that matters, because players, banks and business partners all need that kind of verification.
One thing the regulator has made clear is that existing licences are still good to go, they can’t be cancelled by the stopgap portal launch. For the operators, that means they still have to comply with all the same rules as before, so this technical hitch won’t be getting in the way of them doing business.
The Hack that Brought the System Down
It all started with a suspicious account, one that should have been queried from the get-go.
According to the CGA’s statement, the attack happened through a customer interface that was supposed to be secure. The account was set up in December 2025 under a fake name, but it did use a real company name that actually existed in Curaçaos business registry. The access went on for nearly 9 months.
Then a Berlin-based security specialist came forward, taking credit for the hack. Apparently they had set up the account under a fake identity and name, and had access for nearly 9 months before the CGA discovered the breach on 17 Sept.
Contents of the Leaked Files
There is no definitive figure available at the moment on how many documents have been leaked, although some media outlets put it at more than 40,000. These include statements of ownership, license applications, regulatory evaluations, and taxes among other things. CGA has not yet verified this figure.
According to Follow the Money, there are some 800 names identified in the documents that are the owners of close to 650 gambling businesses with licenses. Passports and tax returns are also mentioned as well as regulatory evaluations of the applicants.
Missed Deadline in Connection With Fixing the Issue
This week’s news about fixing the issues comes in the wake of a previous error made earlier in the month.
On 7 October, the CGA announced that it was not planning to restore the services offered via the old portal and would not be renewing the service agreement related to it. It also promised that there would be further updates on interim arrangements by 9 October. However, no such update came despite a notice sent out earlier saying operators should not send documents via email.
In industry reports, the above-mentioned service arrangements had connections with Random Consulting – a company owned by former Malta Gaming Authority executive Mario Galea.
Another Deadline for License Holders
Licensees need to be mindful of another deadline according to the LOK. As per Article 5.16(4) of the LOK, license holders must ensure that suppliers of critical services or materials are registered. As per the CGA, registration was expected to open in October 2026 with a deadline of 24 December 2026. At the same time that CGA rebuilds the portal, it is pursuing the leaked documents as well.
The regulator says it has filed complaints with Curaçao, Germany, and Netherlands authorities in connection with the leak. It has also hired companies specialising in taking down online information as well as an independent investigation into the leak. Legal action may also be taken.
However, getting rid of this information is likely to be quite difficult. In March 2026, Wittmann managed to breach MGA systems and later said that a Berlin court had allowed her access to the documents while preventing her access to MGA’s systems.
The Fiasco Behind Curaçao’s Licensing Portal
The botched system has a sorry history, and that makes its collapse especially awkward for Curaçao.
Back in 2023, the Ministry of Finance told the Gaming Control Board to overhaul its online gambling oversight, and they didn’t have a choice. International pressure, mounting player complaints, new agreements with the Netherlands and an impending review from the CFATF all piled on. That’s why Curaçao passed a new gambling law on 24 Dec 2024, shifting the CGA’s responsibilities from the Gaming Control Board to the Ministry of Justice on Aug 19, 2025.
When it came to implementing this new law, the CGA knew they needed expertise so they opted for an external portal, at least for now, with plans to take it back in-house later down the line. Since 2024, they’ve been recruiting, snapping up 14 new staff, mostly to help with licensing, supervision and enforcement. But now, thanks to the breach, they’re having to bring that in-house a whole lot sooner than they wanted to.
What It Means for Operators?
Three issues in particular will show whether this temporary portal is a step in the right direction or just a sticking plaster.
The first one is the digital seal, if the verification process remains patchy, then license status checks could slow down onboarding. The second issue is about due diligence, with banks and payment firms now able to access the same ownership reporting as the regulators, it’s a concern. And the third one is about fraud, with application data leaked, it’s a worry that fake CGA emails could start looking incredibly convincing.
The Bigger Picture: Where The Real Problem Lies
We reckon the industry is barking up the wrong tree when it comes to the real villain here. The CGA calls the hack a ‘criminal act’ but the files that got exposed raise some serious questions about the regulator, rather than the researcher.
Our sources at Follow the Money have reported that the ownership doubts around Stake and 1xBet that were flagged up by the assessors were ignored and licenses were still granted. The CGA said it was okay because the companies had some time to sort it out, but Forensic accountancy Professor Marcel Pheijffer thinks that’s rubbish and describes the Stake license as “incomprehensible”.
We take it that a transition period is one thing but approving owners with unclear control is another altogether. We think you can’t use a transition period to excuse slow paperwork, that’s just a bit too convenient. Defenders of the CGA will say that refusing every uncertain applicant would have cleared the market out overnight, but that just highlights the problem in the first place.
We also have concerns about how operators got through the gate, a portal meant to verify identities ended up allowing a foundation tied to a personal Gmail address. The CGA always planned on switching to an in-house portal, so it’s not like they’ve suddenly admitted they couldn’t handle the job. In our view, though, that doesn’t excuse outsourcing the gate in the first place, the regulator still has a duty to guard it.
The temporary portal will get the system up and running again, but rebuilding trust will take something a lot harder: revisiting the files the leak exposed and being honest with the industry about what they find.
Share
4 views
