← Curaçao Gaming Authority (CGA)

2026 Curaçao Gaming Authority — licensing portal unauthorized access; licensees notified

2026 Unknown records affected Share on X

Data compromised

CGA confirmed unauthorized portal access and notified licensees; full census of accessed material pending investigation. Researcher Lilith Wittmann claimed ~9 months’ access and published searchable releases of tens of thousands of licensing documents (~40k+ files; FTM cites ownership data for ~646 licensed companies / ~800 UBOs). Operator/licensee application materials, ownership, and internal assessments alleged in press — treat researcher-published volumes as secondary to CGA’s confirmed unauthorized-access notice.

Technical writeup

Verified regulator disclosure — Curaçao Gaming Authority (Sep 17, 2026) identified unauthorized access to its online gaming portal, contained it, identified the source, and launched forensics; licensees notified. Follow-up: access via false-identity account created Dec 2025 lasting ~nine months until Sep 2026; customer-facing portal section; CGA upgrading back-office/customer interface security. German researcher Lilith Wittmann claimed responsibility and released searchable licensing document sets (CasinoSecrets / FTM/NDR/NRK/SVT reporting). CGA says full extent of material obtained still under investigation. recordsAffected 0 (no person census); companyConfirmed true.

Root cause

Unauthorized access to CGA online gaming licensing portal via account registered under false identity (Dec 2025–Sep 2026); contained after discovery (CGA statements)

References

Breaches you may like

Sign in to monitor vendor exposures, observe your organization's attack surface and security posture, access timely breach intelligence, provision API credentials, and run external security scans—all within one consolidated, secure workspace.

Log in →