Curacao Scraps Hacked Licensing Portal, Misses Its Own Update Deadline
Key Takeaways
- Curaçao’s regulator said on Oct. 7 that its hacked licensing portal “will not be returned to service.”
- It targeted Oct. 9 for details of interim arrangements but had posted no update by Tuesday.
No Portal and No Interim Plan
The Curaçao Gaming Authority (CGA) announced on Oct. 7 that its online gaming portal “will not be returned to service,” and that the “associated service arrangements supporting the platform” would end with it. The regulator credited the portal with supporting Curaçao’s online gaming reform since 2024. In practice, it was the website where companies applied for a Curaçao license and uploaded the documents the regulator reviews, from ownership records to compliance policies, and the system the leaked files were taken from. It was already offline, according to an Oct. 2 notice.
Licensing, compliance, and supervision “will continue through alternative arrangements while an interim solution is being implemented,” the CGA said, with details “currently targeted for no later than October 9, 2026.” As of Tuesday morning UTC, the regulator’s news page listed nothing after the Oct. 7 announcement. The Oct. 2 notice told operators not to email documents meant for the portal, because “such submissions cannot be processed through alternative channels at this time,” and postponed portal filing deadlines until the portal came back, which the CGA has since said it won’t.
The CGA said the “availability of the current digital seal will be affected” and that it would “shortly introduce an alternative mechanism” for operators to show a domain is licensed. On Tuesday morning, the certificate page behind crypto casino Shuffle’s seal still loaded and listed its Curaçao license as active. The regulator says existing licenses remain valid and operators’ obligations are unchanged. The seal is a badge that licensed casinos such as Shuffle display on their sites, linking to a certificate page on the regulator’s website that names the company behind the site, its license number and status, and the other domains it runs, so visitors can check that a casino is licensed.
The CGA disclosed unauthorized access to the portal on Sept. 17. In a Sept. 22 follow-up, it said a German security researcher had entered through an account registered in December 2025 under a false identity and kept access until September, called it “a serious breach under Curacao law,” and said it would report it to the relevant authorities. It also said it “will not repeat figures it cannot verify” about what was taken.
Hacker Lilith Wittmann has published more than 40,000 of the portal’s documents as the “Casino Secrets” leak, which surfaced a revenue-sharing deal between British bookmakers’ content supplier SIS and Mystake operator Santeda, among other things. Follow the Money, which published the main investigation into the files with European media partners, said they identified roughly 800 owners of nearly 650 Curaçao-licensed companies. In a separate case, Wittmann said in September that a Berlin court had ruled for her against the Malta Gaming Authority, which had won an interim injunction against her after she breached its systems in March. By her account, she may keep using the Malta documents but may not access its systems again.
