Curaçao's Licensing Portal Was Breached for 9 Months — Here's What We Know

Dr. Annelies De Vos · 2026-09-24

Imagine finding out someone had access to your systems for nine months — and you only just noticed. That's essentially what happened to the Curaçao Gaming Authority, and it's raising some serious questions for anyone involved in online gaming. ### What Actually Happened The Curaçao Gaming Authority confirmed that unauthorized access to its online gaming licensing portal went undetected for roughly nine months. The breach started in December 2025 and wasn't shut down until September 2026. Here's the kicker: the account used to get in was created with a fake identity. So someone deliberately set up a fraudulent profile and used it to access the customer-facing section of the portal. As of now, the regulator says there's no confirmed compromise of its core technical infrastructure. But they're still investigating exactly what information was accessed. ### Why This Matters More Than You Think Curaçao has long been a major licensing jurisdiction for online casinos. Tons of operators — especially those serving markets like Mexico — rely on Curaçao licenses to legally offer their services. So when the licensing portal gets breached, it's not just a tech headache. It's a trust issue. Think about it: if someone can create a fake account and poke around for nine months, what does that say about the security of the licensing process itself? > "A breach isn't just about what was taken. It's about what people now doubt." That's the real damage here. Even if no sensitive data was compromised, the perception alone can shake confidence. ### What We Still Don't Know The regulator hasn't released details on: - What specific information, if any, was obtained - Whether any license applications or operator data were affected - How the fake account passed initial verification - What security upgrades are being implemented These are big gaps. And for professionals in the online gaming space — especially those working with Mexican markets — they matter. ### What This Means for the Industry If you're an operator, a compliance officer, or just someone who follows online gaming regulation, this should be a wake-up call. Licensing portals aren't just administrative tools. They're gateways to sensitive data. Regulators need to treat them that way. And the industry needs to ask harder questions about how these systems are protected. For now, the Curaçao Gaming Authority says it's investigating. But nine months is a long time. And the fact that it took that long to detect the breach is the part that should worry people most. We'll keep watching this one. Because in an industry built on trust, breaches like this leave a mark — even after the portal is secured.