The Curaçao Gaming Authority said unauthorised access to its online gaming portal was detected and contained on Sept. 17, but investigators have yet to establish the incident’s full scope or determine what information, if any, was accessed.
The regulator said its core technical infrastructure had not been compromised, based on the investigation so far. It activated incident-response procedures with its service provider immediately after detecting the breach, and the provider began a forensic investigation. The CGA has also introduced additional monitoring and security measures while the inquiry continues.
The authority is assessing the potential consequences of any access. It said it would directly notify individuals, applicants, licensees and other stakeholders where the investigation finds that their information may have been affected, in line with applicable legal and regulatory requirements.
The breach has prompted unverified concern about the possible exposure of information held on behalf of online casino operators. Protos reported that users on X speculated that photo identification and other personal material connected to crypto casinos could have been taken and used for leaks or extortion. The CGA has not confirmed that any such data was accessed.
As we reported in July, the regulator has set a phased crypto policy for B2C licensees that emphasises traceability and tighter checks. Separately, the CGA released proposed information-security control requirements for consultation in April, including multi-factor authentication for internet-facing applications, monthly vulnerability scans and a 24-hour reporting deadline for certain incidents affecting personal data, player funds, gaming integrity or system availability.
The CGA said it would provide further updates as additional facts are established, while declining to disclose more details during its engagement with relevant authorities.
