CGA DETAILS SECURITY MEASURES, DATA MIGRATION AND NEXT STEPS FOLLOWING PORTAL BREACH
The Curaçao Gaming Authority (CGA) has provided a detailed update to the online gaming sector on the September data breach, the measures taken since the incident and the operation of its replacement licensing portal.
The communication outlines the steps taken to investigate the breach, pursue legal action and limit the further distribution of information obtained without authorisation. It also provides details of the security measures introduced in the interim portal, which is now being rolled out to operators.
Legal action and investigation
Following confirmation of the unauthorised access on 17 September 2026, the CGA filed criminal complaints in Curaçao, Germany and the Netherlands. It has also engaged specialist companies to assist in removing personal information published online.
The authority has appointed legal counsel in Curaçao and Germany to pursue appropriate civil remedies against the individual it identifies as responsible for the incident. A formal complaint is also being pursued with the competent German data protection authority concerning the publication of personal data.
The CGA says it continues to explore all available legal options to protect the interests of affected parties and prevent further dissemination and use of the information obtained.
New portal undergoes independent security testing
The CGA has also provided further details about the security of its interim portal, which was developed on its own infrastructure following the decision to discontinue the previous system.
Before going live, the replacement platform underwent an independent penetration test conducted by Arcas Partners between 10 and 19 October 2026. The assessment covered the client portal, registration form, staff back office and public register.
Testing included attempts to access other organisations’ data, obtain higher access privileges, misuse file uploads and introduce malicious code. According to the CGA, all findings were addressed before the portal went live.
The authority has also confirmed that security testing will be repeated at least annually and whenever significant changes are made to the platform.
Security measures and data protection
The CGA’s update provides a breakdown of the safeguards introduced in the new system.
Access is restricted to users invited personally by the CGA or an approved administrator within their organisation. Self-registration is not possible, and each invitation link can only be used once and expires after 14 days. Multi-factor authentication through Microsoft is required for every sign-in.
Organisations can only access their own operators and information, while CGA staff permissions are restricted according to their individual roles. Sign-ins, account changes and security events are logged through Microsoft Sentinel, with continuous monitoring provided by the CGA’s security provider.
The portal also uses a web application firewall to block known attack patterns. Information transmitted through the platform is encrypted using HTTPS, while documents and data are stored in the CGA’s own Microsoft cloud environment in Europe and encrypted at rest.
Only PDF documents can be uploaded, and submitted documents are accessible only to the organisation concerned and authorised CGA personnel.
Previous portal data successfully migrated
An important part of the update concerns the transfer of information from the previous licensing portal.
The CGA confirms that operator and licence data has been migrated to the new environment. The migration was checked on an organisation-by-organisation basis, with records reconciled against the original source.
The authority also verified a sample of more than 11,000 documents against their originals using SHA-256 digital fingerprints. According to the CGA, no discrepancies were identified.
The previous portal has now been decommissioned from active use. Its database is retained in a read-only, securely isolated environment, with access strictly restricted.
What operators need to know
The rollout of the interim portal began during the week of 19 October and is continuing. The CGA acknowledges that some operational issues may arise while the new system is being introduced and has asked operators for their cooperation and patience during this period.
A user manual has already been provided, and workshops to familiarise operators with the portal are planned.
One particularly important point concerns digital seals. The interim portal operates its own seal server, meaning operators should implement the corresponding change on their domains as soon as possible. The CGA is providing further information to help licence holders with this process.
The interim portal does not yet offer all the functionality of its predecessor, but includes the features considered necessary for operators and CGA staff to resume their activities. For the longer term, the authority intends to initiate a Request for Proposal process for the development of a permanent replacement.
The CGA has also outlined its approach to future security incidents. The portal is continuously monitored, and any incident will be contained, investigated and addressed. Affected licence holders and applicants will be notified without undue delay, with regular updates provided until the matter is resolved.
The latest communication provides operators with a clearer picture of the work undertaken since September, the safeguards introduced in the replacement system and the practical steps still required. While work on the permanent portal and the consequences of the breach continues, the CGA says it remains committed to keeping the sector informed and protecting the interests of affected parties.
