Curaçao's Licensing Portal Breach Went Undetected for 9 Months

Dr. Annelies De Vos · 2026-09-24

### The Breach Nobody Noticed for Nine Months Imagine a door left unlocked for nine months. That's essentially what happened at the Curaçao Gaming Authority. The regulator has now confirmed that unauthorized access to its online gaming licensing portal went on for roughly nine months before anyone caught on. It was finally shut down in September 2026. That's a long time in the dark. The account behind the access was created back in December 2025 using a false identity. Think about that. Someone set up a fake profile, slipped in through the customer-facing side of the portal, and stayed there for months without raising alarms. It's the kind of thing that makes you wonder what else might be going unnoticed. ### What We Know About the Access Here's the good news, relatively speaking: the regulator says there's no confirmed compromise of its core technical infrastructure. The breach happened through the customer-facing section, not the deep internal systems. That's a small relief, but it doesn't erase the fact that someone had unauthorized access for three-quarters of a year. - The fake account was created in December 2025 - Access continued until September 2026 - The breach was limited to the customer-facing portal - No confirmed compromise of core infrastructure - Investigation into what information was obtained is ongoing ### Why This Matters for the Online Casino World If you're in the online gambling business, this should get your attention. Licensing portals hold sensitive data. They're the gatekeepers for operators who want to legally offer games in regulated markets. When that gate gets left ajar, even a little, it raises questions about oversight and security. Curaçao has long been a major licensing jurisdiction for online casinos. Many operators rely on Curaçao licenses to serve markets around the world. So when the regulator itself has a security lapse, it's not just an internal problem. It's a signal to the entire industry. As one industry observer put it: "Trust is the currency of regulated gaming. When the regulator's own systems are compromised, that trust takes a hit." ### What Happens Next The Curaçao Gaming Authority says it's still investigating what information was obtained. That's the big unknown right now. Was it just access? Or did the intruder walk away with personal data, licensing documents, or something else? For operators and players alike, the waiting game is frustrating. But it's also a reminder that cybersecurity isn't a one-time fix. It's an ongoing process. Even regulators need to stay vigilant. ### The Bigger Picture This incident shines a light on something the online gaming world doesn't always like to talk about: security vulnerabilities. Whether you're a player logging into your favorite casino or a regulator managing licenses, the digital doors need to be locked. And someone needs to check them regularly. Nine months is a long time to leave a door open. Let's hope it's a wake-up call rather than a sign of things to come. The investigation continues. We'll keep watching for updates.