Key Points
- Curaçao Gaming Auth. has confirmed they’re ditching the hacked licensing portal for good, and ending the dodgy service deal that was attached to it.
- Licences are still valid, but the regulator’s admitted they won’t be able to put their digital seal on them until they get a new system up & running.
- The CGA said they’d share details of their plans by 9 October, but now it’s 12 October and there’s still zip.
A High Profile Security Blunder Leaves A Trail
What happens when the main door to a regulator’s operation gets left wide open by a hacker and never gets closed? Curaçao’s online gaming sector is finding out the hard way, one bland press release at a time. The Curaçao Gaming Authority (CGA) issued a statement on 7th October which basically said their hacked online gaming portal “won’t be coming back” and that’s about it. They also canned the deal to run the platform, a bit of short notice with a lot of big implications.
The regulator has taken to speaking in very measured tones to describe an extremely awkward situation for the island. “We’re taking the necessary steps to switch to a new platform & make sure we can keep regulating the online gaming sector, but without any more problems,” the authority said. Not exactly the sort of glowing tribute you’d expect to hear from a regulator marking the end of a hacked system.
Licences Still Valid, But What About The Seal?
Operators with a Curaçao licence can breathe a bit of a sigh of relief, at least in theory. “The shutdown of the portal doesn’t make any difference to whether a licence is valid or not, or what the operators have to do next,” the authority said a bit blandly. The regulator is still going to do all the usual stuff like checking for compliance & making sure everyone’s doing what they’re supposed to, but they’re doing it through “alternative arrangements”, which is regulatory speak for “something is still to be worked out”.
The digital seal which players use to check if a website is licensed is the real problem here. The CGA admitted that the seal will still be dodgy for a bit, and an alternative is apparently on the way. No idea when exactly, or even the sort of system they’re planning on introducing. That’s not exactly reassuring news for operators waiting to hear what’s going on, or when they can expect to get on with things.
Timing is the thing that’s really getting under the skin of operators now, because the authority promised we’d have a lot more info on the plans by 9 October, but 12 October comes around, and still nothing. We’re only getting told there will be information, not that the regulator actually has a system up & running. Needs a bit more work on that front.
Nine Months Inside The Regulator’s Files
While the shutdown does make a lot more sense now when you see how the data breach happened. Initially, CGA reported the unauthorised access to its systems on 17 September and claimed that the situation was contained and that the source of the intrusion was discovered. Five days later, CGA announced that the entry point was a fake account that was registered back in December 2025. This access continued up until September 2026, and CGA has not been able to identify what information got leaked.
Lilith Wittman, a German researcher, claimed the hack back then, stating that she had gained access to CGA systems since December 2025. As per her publication in an article on her website, which later was quoted by NEXT.io, “From then on, it took less than eight hours for me to exploit an easily identifiable security vulnerability and gain full access to the gambling regulator’s servers.”
Working alongside NDR, NRK, SVT, and Follow the Money, she leaked all of the information via the hashtag #casinosecrets. Earlier in 2026, she had been blamed for hacking into the Malta Gaming Authority. Sources claim that the published data consists of over 40,000 documents related to around 650 licensed companies and about 800 owners. CGA denies the number and will not confirm it until it is proven by its own investigation.
What The Leaked Files Reveal About Licensing?
Apart from the weakness in security measures, this leak placed the regulator under pressure regarding the quality of its licensing process. In its coverage of Casino Secrets, The Guardian claims that there are more than 8,000 casinos in Curaçao’s online gambling industry. That means that there is a casino for every 20 people living on the island. As per the article, there are Stake.com, BC.Game, and Santeda networks, which according to another article in The Guardian, appear to target vulnerable gamblers in the UK.
The most attention was drawn towards Stake’s file, as the Australian Financial Review reported on 25 September. CGA officials raised questions as to why the names of the founders Ed Craven and Bijan Tehrani were missing from the license application. Furthermore, year-end balances from 2021, 2022, and 2023 showed that the applicant only made a profit of 0.06% overall.
The Consultant At The Back Of This Whole Mess
Closing out the service deal also speaks volumes about the company that built the portal in the first place. And so Times of Malta reported, the decision to pull the plug on Random Consulting Ltd effectively cuts ties with Mario Galea, the former MGA boss who has been at the helm of that firm. His company had been hired back in 2022 to sort out a new licensing system in Curaçao, and the portal had gone live just the following year in 2023.
Right from the get-go, things have been pretty rocky for the project. An opposition MP raised questions about fraud involving Galea and others, claims he said were “baseless and without foundation”. Finance Minister Charles Cooper then announced an investigation into reports of the firm being paid €4 million a year. Random Consulting though disputed those numbers, and the CGA never gave a proper reason for ending the deal with them.
A Young Regulator With A Very Troubled History
Suddenly having this shut down hits an authority that’s never really known as a quiet spell. The National Ordinance on Games of Chance, also referred to as the LOK, actually kicked in on December 24 2024, but just a few months later in September 2025, the supervisory board for the CGA resigned en masse. This left the brand new regulator without a governing body.
Exit procedures then got a lot tougher pretty quickly after that, making it more expensive if there was any confusion when it came to admin stuff. The CGA’s rules for this kind of wind-down from last July set a six-week deadline for firms who weren’t granted a further licence. They have to remove the seal, sort out player claims, and get a local managing director to sign off on things. With the portal now gone, no one is really clear on how all those reports are meant to reach the authority.
Questions That Still Don’t Have Answers
Several practical questions have been left hanging for operators, suppliers and players, and none of them has a clear answer yet. Where do licence applications go now? Who is meant to process them before they get sorted out by the interim solution? We still don’t know. How do players confirm that a seal is genuine when it’s all been affected? The CGA admits the transition will create headaches for operators, and we still have no update on the data leak.
Expert Analysis: Curaçao Is Selling Trust That It’s Not Even Got
We think this shutdown is a much bigger deal than if they were just switching to a new version of software. Since 2024 Curaçao’s message has been clear, the low-cost licence comes with some serious oversight. But that promise was built into the portal they built, opened by one researcher in less than 8 hours in 2023, and made by one consultancy.
Our biggest concern is the licence seal, not that the CGA is replacing its servers. If a badge that players can’t even check is the best you can do, then it carries no weight at all, and fake badges will just thrive in that kind of confusion.
A reader can expect to disagree with us over this in Stake’s file. The CGA argues that single documents aren’t enough to provide context, and that following up on unanswered questions after licensing clears things up, but we find that defence a bit weak. You should deal with ownership questions first, not grant a licence first and then sort them afterwards, it’s pretty basic.
One counterpoint we do accept though is that scrapping a breached system may have been the only sensible option available.
Our verdict is pretty blunt, Curaçao’s reputation right now is on the line and they need to move fast and give straight answers, not just make reassuring statements.
Share
4 views
