Curaçao Gaming Regulator Hit by Data Leak
A hacker took licence-holder files from Curaçao's gaming regulator. Licences stay valid and the seal is being replaced; here's what it means for players.
Published November 4, 2026· By Evan Kowalski
Curaçao is the licence behind most crypto casinos, and its regulator, the Curaçao Gaming Authority (CGA), has spent the last seven weeks dealing with a leak from its own licensing website. It doesn’t change the validity of your casino’s licence. It does put a spotlight on how licences were handed out.
Nine Months Under a Fake Name
On 17 September 2026 the CGA said it had found unauthorized access to its online gaming portal, the website licence holders use to deal with the regulator. The access was contained, it said, and so far it had found no sign that its core systems were hit [1].
Five days later a German security researcher told the media they had got in and pulled out data about Curaçao operators, plus internal CGA documents. The CGA confirmed this matched its own findings [2].
The entry point was an ordinary customer account. It was registered in December 2025 under a false identity: a variant of a real person’s name, attached to a company that really exists in Curaçao’s business register. Nobody noticed until September 2026 [2].
Complaints in Three Countries
The CGA calls it criminal conduct. It has filed complaints in Curaçao, Germany and the Netherlands, hired specialists to get the material taken off the internet, commissioned an independent technical investigation, and is considering a civil lawsuit [4].
The size of the haul is unclear. Follow the Money (FTM), an investigative outlet, says the hacker got “tens of thousands” of confidential documents [5]. The CGA says it “will not repeat figures it cannot verify” and that the full extent is still being established [2][4].
Owners’ Files, Not Player Accounts
The CGA describes the material as “data and confidential information belonging to online gambling license holders” [4]. FTM’s reporting is built on licence applications: who owns each company and how the regulator checked them [5]. In other words, the leak concerns licence holders and the people behind them.
None of the sources say that player accounts, player data or balances were involved.
The Licence Stays, the Badge Changes
When the CGA announced on 7 October that the old portal would not come back, it added that this “does not affect the validity of existing licenses” [3]. On 19 October it repeated it: “Closing the previous portal does not invalidate existing licenses. Companies with a CGA license must continue to meet their obligations” [4].
A temporary portal went live on Monday, 19 October [6], and the CGA said its licence register and digital seal system were due to come with it. A portal of its own is in the works; the old one was run by an outside company [4].
The visible change is the digital seal, the clickable “licensed” badge in a casino’s footer. The CGA says the current seal is affected and a new way to show that a domain is licensed will replace it [3]. Law firm EM Group says licensees are to get new seal codes once they become available [7].
A footer badge is the casino’s own claim anyway. To check a licence yourself, use the CGA’s licence register on cga.cw. Our Curaçao licence explainer explains what to look for.
The Ownership Question
The part that will matter longer is what FTM says the documents show. Working with NRK, NDR, Jetzt and SVT on an investigation called “Casino Secrets”, it analysed the 646 organisations licensed as of December and verified 897 ultimate-owner records covering 767 people [5].
FTM’s reading: the regulator often granted licences without establishing whether the declared owners really controlled the company. Assessors flagged problems but accepted vague or incomplete answers, and some owners’ wealth looked unclear or too small to be credible [5].
Among the four operators FTM named are two you may know:
- Stake (licence holder Medium Rare N.V.): FTM says the registered owner declared assets of over $1 billion, officials questioned whether that person was the sole owner, and the better-known founders weren’t named in the application [5].
- 1xBet (licence holder Caecus N.V.): FTM says the registered owner had no other visible link to the site, assessors suspected several owners, and the licence was granted without the answers they had asked for [5].
The licence-holder names match those in our Stake review and 1xBet review. These are FTM’s findings. FTM puts no figure on harm to players, but quotes experts who warn that hidden ownership raises money-laundering risk, especially with crypto [5].
The CGA told FTM it didn’t refuse licences at the first sign of uncertainty because of a transition period under the 2024 law; experts quoted by FTM call that justification invalid [5]. The CGA also says it has followed robust due-diligence procedures since the 2024 reform, and that it “does not find it prudent” to judge its licensing from separate documents without the full context of each application [2].
Oversight, Not a Guarantee
A Curaçao licence is a layer of oversight, not a promise that a casino is clean. As the CGA rebuilds, the thing to watch is how openly it shows who actually owns the companies it licenses. Our list of Curaçao casinos shows which ones we review, and the Anjouan vs Curaçao comparison covers how the two licences differ.