Curaçao's casino regulator was breached. What it means for players

Curaçao licenses more of the crypto casinos we track than any other regulator except Anjouan: 17 of them, among them Stake, Roobet, Shuffle, Rollbit, Cloudbet and Duelbits. In October 2026 its regulator, the Curaçao Gaming Authority (CGA), said its online licensing portal had been breached. Everything below is from the CGA's own announcements of 2, 7 and 19 October 2026.

What the regulator said happened

In a release dated 19 October, the CGA says that on 17 September it discovered that "a digital security researcher from Germany had gained access to its online gambling licensing portal without proper permission in December 2025", and that this person "accessed and published data and confidential information belonging to online gambling license holders". It says the unlawful access ran from December 2025 to September 2026, and affected the portal and its database, which an external company managed.

The CGA says it has filed complaints with authorities in Curaçao, Germany and the Netherlands, hired specialist companies to get the published information taken down, commissioned an independent technical investigation, and is considering civil action.

The data at stake is licence holders' data, that is, the companies running casinos and the documents they filed to get a licence. The CGA does not say that player accounts or player funds were part of the portal, and we have no information beyond its releases.

The portal is gone for good

The CGA first took the portal offline. A notice filed on 2 October told operators not to email portal submissions instead, and postponed deadlines for submitting documents through the portal until it returns.

On 7 October it went further: the portal "will not be returned to service", and the CGA is ending the service arrangements behind it. The same notice says: "Given that the availability of the current digital seal will be affected, the CGA will shortly introduce an alternative mechanism through which operators can demonstrate that a domain is licensed by the CGA."

The 19 October release says a temporary portal was scheduled to launch that Monday, 19 October, with the licence register and the digital seal system scheduled to become available with it. The CGA plans to build and run a new portal itself after that.

Licences still stand

All three announcements say the same thing: closing the portal does not affect the validity of existing licences, and licensed operators must keep meeting their obligations.

What this means if you play at a Curaçao casino

A broken seal is not proof of a lost licence, for now. Curaçao casinos show a clickable seal in their footer that opens the regulator's licence check. While the CGA moves that system, a seal may not load or may show nothing. That is the changeover the CGA describes, not by itself a sign the casino lost its licence.

Check the register when it is back. The CGA's licence register lists licensed companies. Our casino profiles name the licence and operating company each casino states, with a link to the casino's own page, so you can compare the two.

Nothing here changes how to protect your balance. A casino balance is held by the casino. Keep only what you are playing with on-site, turn on two-factor authentication, and withdraw what you are not using.

We will update this page when the CGA publishes more, and when the register and seals are working again.