Curaçao Gaming Authority breach: the portal is closed, the regulator is not

The Curaçao Gaming Authority licenses a large share of the world’s offshore online casinos, including two in our index. This report sets out what the CGA itself has said about the breach of its licensing portal, what the journalists who received the files reported, and what is still unknown. A common reading — that Curaçao has stopped licensing — is not what the CGA’s announcements say. We read every source on 15 October 2026.

01What the CGA said

The CGA first disclosed the breach on 17 September 2026: unauthorised access to its online gaming portal, contained and its source identified, with a forensic investigation under way by its service provider. It said its core technical infrastructure showed no compromise so far and that it would notify anyone whose information may have been affected.¹

Its follow-up of 22 September was more specific. The account used had been registered in December 2025 under a false identity — a variant of a real person’s name combined with a company that exists in the Curaçao Chamber of Commerce register — and access ran through the customer-facing side of the portal until it was found and ended in September 2026.² The CGA called it a serious breach under Curaçao law and said it would report it to the authorities.²

“The CGA will not repeat figures it cannot verify.”

Curaçao Gaming Authority, 22 September 2026²

It also defended its licensing: robust due diligence since the reform began in 2024, with open questions followed up before decisions, and a warning against reading separate documents without each application’s full context.²

02How the access happened, as reported

Follow the Money’s account names the researcher: Lilith Wittmann, based in Berlin, who had previously broken into the Malta Gaming Authority’s systems. In December she registered on the portal using the name of a Dutch trust-office manager known to the regulator, her own Gmail address and a foundation she had invented. Access was granted within days, after which, FTM reports, she uploaded software that gave her control of the portal and the documents stored on it.³

The two accounts differ in one detail: FTM describes the company as invented, the CGA as one that exists in the Chamber of Commerce register.^2,3 The Curaçao Chronicle reported that the CGA found the researcher’s claims consistent with its own findings.⁴

Our analysis The weakness described is not exotic. A licensing portal that let a newcomer act for licensees on the strength of a familiar name and a free e-mail address had no meaningful identity check at the door.

03What the documents showed

FTM and its partners — NRK in Norway, NDR in Germany, Jetzt in Austria and SVT in Sweden — published on 22 September 2026 as “Casino Secrets”. FTM reports tens of thousands of confidential documents, about 800 owners of nearly 650 licensed gambling firms, and 646 organisations licensed as of December; it verified 897 ownership records covering 767 people. It used only material obtained before it contacted the researcher.³

Across the files, FTM reports, assessors repeatedly recommended licences while questions about ownership, source of wealth or financial capacity were still open; among the licences it describes as granted that way are those of the operators behind Stake and 1xBet. Some files also showed operators active in countries where they held no licence.³ The CGA, FTM reports, did not dispute that licences were granted with questions unresolved, and pointed to the transition under the 2024 law: its principle was not to refuse a licence or end existing activity immediately whenever there was a question.³

Velven does not repeat the personal details in the leaked files. They concern private individuals and were obtained without authorisation; the findings above are FTM’s, at the level FTM published them.

04The portal is retired, the regulator is not

On 2 October 2026 the CGA published an announcement about the portal.⁵ On 7 October it went further: the current online gaming portal “will not be returned to service”, and its discontinuation ends the service arrangements that supported it.⁶

The same announcement sets out what does not change:⁶

• Existing licences remain valid, and licensed operators keep their obligations.
• The CGA’s regulatory and supervisory responsibilities are unchanged.
• Licensing, compliance and supervision continue through alternative arrangements; an interim solution is being set up.
• The digital seal will be affected, and a replacement way to show that a domain is CGA-licensed will follow “shortly”.

The CGA said it would give details no later than 9 October 2026.⁶ On 15 October 2026 its news page listed nothing newer than the 7 October announcement.⁵ The announcement does not say the breach is why the portal was retired; it mentions the breach separately, as an incident it is still containing.⁶

05Timeline

1. 2024

   Curaçao’s online gaming reform begins; the portal supports it, the CGA says.⁶

2. Dec 2025

   An account is registered on the portal under a false identity.^2,3

3. Sep 2026

   The access is found and ended, after about nine months.²

4. 17 Sep 2026

   The CGA announces it is investigating unauthorised access.¹

5. 22 Sep 2026

   FTM and four broadcasters publish “Casino Secrets”; the CGA confirms the account dates from December 2025.^2,3

6. 2 Oct 2026

   The CGA publishes an announcement about the portal.⁵

7. 7 Oct 2026

   The portal will not return; licences remain valid; the seal will be replaced.⁶

8. 9 Oct 2026

   The date the CGA set for details of the interim arrangements.⁶

9. 15 Oct 2026

   No later announcement is listed on the CGA’s news page.⁵

06What is still unclear

• How much was taken. The CGA says the full extent has not been established and it will not repeat unverified figures.²
• What replaces the portal, and when. The interim arrangements promised by 9 October had not been published by 15 October.^5,6
• How a licence will be verified meanwhile. The seal is affected and its replacement has not been described.⁶
• Whether licences granted with open questions will be revisited. The CGA has not said.
• Who ran the portal. The CGA names no service provider in its announcements.

07What it means for players

For a player at a Curaçao-licensed casino, nothing in the CGA’s announcements changes the licence itself: it remains valid.⁶ What changes is the ability to check it. A seal that no longer verifies is not, for now, evidence that a licence was withdrawn.

Our analysis The leak’s lasting point is the one FTM documents: in the reform’s first years, a Curaçao licence was granted in some cases before the regulator had settled who owned the business or where its money came from.³ A licence number tells you which regulator a casino answers to. It does not tell you how closely that regulator looked.

Two casinos in our index hold CGA licences: Shuffle (OGL/2024/1337/0628) and Vavada (OGL/2024/252/0153). Neither score changes: the licence component of the Trust Score rates the regulator tier, which this does not move, and our methodology is fixed. Velven has an affiliate relationship with Shuffle: we earn a commission on sign-ups through our link. It is not an input to the Trust Score and played no part in this report. Velven has no affiliate relationship with Vavada.

08How to check a casino’s licence now

1. Read the licence number in the casino’s footer. Curaçao licences under the new law take the form OGL/2024/…; note the company it is issued to.
2. Match the company to the terms. The operator named in the terms and conditions should be the licensee.
3. Don’t rely on the seal for now. The CGA says it is affected and will be replaced.⁶
4. Watch the CGA’s own announcements. Its news page is where the interim arrangements will be published.⁵
5. Look past the licence. Our reviews set each casino’s licence beside how it actually pays — see how we score.

09Questions