Curaçao Gaming Authority confirms breach of its licensing portal

What has happened

On 17 September 2026 the Curaçao Gaming Authority (CGA) disclosed that there had been unauthorised access to the online portal through which licensed companies file their applications and documents. It said the access had been contained and its source identified.

In a follow-up statement dated 22 September, the CGA said access was obtained through the customer-facing part of the portal, using an account registered in December 2025 under a false identity, and continued until September 2026. It described the access as a serious breach under Curaçao law and said it would report it to the relevant authorities.

The CGA said it had not yet established what information was taken. It has tightened portal security and asked licensed operators to make changes on their side.

Media reporting on the documents

A Berlin-based security researcher has said she held access to the system and obtained tens of thousands of documents, including ownership records, licence applications and the regulator's own assessments. The material is being reported on by Follow the Money (Netherlands) together with NRK, NDR, SVT and other outlets.

According to that reporting, the documents identify around 800 owners of nearly 650 licensed gambling companies. The reporting states that in some cases the regulator's assessors raised questions about declared ownership, including for the Curaçao companies associated with the Stake and 1xBet brands, and licences were granted before those questions were resolved.

The CGA told journalists it did not immediately reject applicants when questions arose because the sector was moving to a new regulatory regime, and it has defended its due diligence since the 2024 reform. None of the reporting establishes wrongdoing by any company or individual named.

What this means for users of this register

• A Curaçao licence remains valid unless and until the CGA suspends or revokes it.
• Curaçao is an offshore licensing jurisdiction. A Curaçao licence does not authorise an operator to offer gambling in countries that require a local licence.
• Always check a licence on the CGA's official public register, and check whether your own country requires a local licence.
• IRLG has not reviewed the leaked material and will not publish anything from it.