Curaçao files criminal complaints over gambling portal hack: why it matters for Belgium too 

A licensing portal is supposed to be a place where a regulator can securely collect confidential information. In Curaçao, however, that very system became the centre of a data breach. The Curaçao Gaming Authority has now filed criminal complaints with authorities in three countries and is working to have leaked information removed from the internet. This marks a new phase in a case that is also relevant to Belgium. 

The Curaçao Gaming Authority (CGA) has reported the incident to authorities in Curaçao, the Netherlands and Germany. The regulator has also hired specialist companies to limit the spread of confidential information. An independent technical investigation is expected to provide greater clarity about the consequences. Potential civil legal action is also being considered. 

These measures are intended to limit the damage and restore the confidence of licence holders. At the same time, important questions remain unanswered: exactly how much information was obtained, who was affected and how could unauthorised access continue for months? 

Criminal complaints in three countries, but few legal details so far 

The CGA outlines its measures in an official statement on the data breach and subsequent actions. According to the authority, it was discovered on September 17, 2026, that a German security researcher had gained unauthorised access to its online licensing portal. 

The regulator states that this access occurred between December 2025 and September 2026. Confidential information belonging to licence holders was accessed, extracted and made public. The CGA describes these actions as criminal and emphasises the consequences for the individuals and businesses involved, as well as for the reputation of Curaçao’s gambling industry. 

The statement does not specify which authorities are handling the complaints. Nor does it explain precisely who the complaints are directed against. This distinction is important: the announcement of legal action does not constitute a court ruling establishing anyone’s guilt. 

Alongside the criminal complaints, the CGA is examining whether civil proceedings are possible. The specific claims being considered have not been disclosed. For now, the authority has only announced that it is exploring these options. 

Behind the leaked documents are people and businesses 

The incident attracted international attention following the involvement of German security researcher Lilith Wittmann and journalistic investigations into documents obtained from the portal. The documents contained information about companies holding Curaçao licences and the individuals behind those businesses. 

Gambling Club previously covered the leaked gambling documents and questions surrounding Curaçao licences. That article explained how investigative journalists examined not only ownership information but also internal assessments and questions concerning corporate structures. 

This makes the case sensitive on two levels. Licence applicants must be able to submit confidential information without it being distributed uncontrollably. At the same time, documents from a regulatory process may raise questions about how companies are assessed. 

These issues each require separate answers. A possible security failure does not, in itself, establish that every licence issued was improper. Conversely, questions about licensing practices do not disappear simply because the regulator objects to the way documents were obtained. 

Removing leaked data is different from investigating the incident 

The CGA has hired specialist companies to help remove confidential information that is available online. The aim is to limit further distribution and protect those affected. 

The statement does not indicate how many removal requests have been submitted or how many have been successful. Nor has the authority disclosed which information remains online. Hiring specialists therefore does not mean that all leaked information has already disappeared. 

An independent technical investigation into the impact and consequences of the incident is also underway. This must be distinguished from efforts to take information offline. Removal may limit further distribution, while the technical investigation should establish what happened and which improvements are necessary. 

Both processes matter to the affected companies and individuals. They need not only to reduce the visibility of their documents but also to understand exactly which information was compromised. A general announcement about a data breach does not yet provide individual answers. 

Why an external provider managed the portal 

In its statement, the CGA also explains why it chose an externally managed licensing portal. According to the regulator, reforming Curaçao’s gambling industry required specialist expertise in technology, licensing and regulatory supervision. 

The authority states that external experts were needed to support this transition. According to the CGA, the intention was eventually to move to a system managed internally. It maintains that responsibility for licensing and regulatory oversight always remained with the authority itself. 

This explanation provides context for how the system was organised, but it does not answer every question about security. What agreements were in place with the provider? How were access permissions monitored? And which warning signs might have revealed unauthorised activity earlier? The published statement does not provide complete answers. 

The CGA also reports that fourteen employees have been recruited since the reform process began, primarily in licensing, supervision and enforcement. The authority aims to build its internal expertise and reduce its dependence on external consultants. 

Cooperation with Random Consulting terminated 

The partnership with Random Consulting, a company linked to former Malta Gaming Authority director Mario Galea, has been terminated. The affected portal will not be brought back online. Instead, the CGA has opted for a temporary solution before developing a new system under its own management. 

Questions had already been raised about payments and responsibilities involving external providers. That discussion is a separate matter. Without the results of an investigation, it cannot be established that financial questions concerning a supplier also explain the data breach. 

The same applies to political pressure on the regulator. Curaçao’s Finance Minister, Charles Cooper, had previously announced his intention to file a criminal complaint against the CGA but, according to reports, is waiting for investigation results. This is separate from the complaints filed by the CGA itself following the data breach. 

It is important for readers to distinguish between these proceedings. An investigation into payments, an investigation into digital access and potential legal action against individuals may overlap, but they do not automatically concern the same facts or lead to the same conclusions. 

Temporary portal scheduled for October 19 

The CGA planned to launch a temporary licensing portal on Monday, October 19, 2026. The licensing register and digital licence seal system were also expected to become available according to that schedule. 

The official statement refers to a planned launch. It does not, by itself, confirm that all components actually became operational on that date. However, the authority explains that independent specialists are expected to conduct security checks and that the customer portal still required adjustments. 

For existing licence holders, the CGA has a clear message: closing the old portal does not invalidate their licences. Businesses must continue to meet their obligations. The administrative infrastructure is changing, but regulatory responsibilities remain in place. 

This does not mean that every licence is beyond challenge. The statement concerns the consequences of closing the portal for existing licences. It does not constitute a separate substantive reassessment of every company operating under Curaçao’s supervision. 

What does this mean for Belgium? 

For Belgian players, the main distinction is straightforward: a Curaçao licence does not replace a licence issued by the Belgian Gaming Commission. An international licensing seal does not automatically give a gambling website the right to offer its services in Belgium. 

Anyone wishing to check which operators are regulated in Belgium can consult the official website of the Belgian Gaming Commission. Whether a company holds a licence elsewhere must be distinguished from whether it is authorised to operate in the Belgian market. 

Gambling Club previously explained this distinction in its article about Stake’s licensing status in Belgium. International recognition, major sponsorship agreements or foreign registration do not replace the required Belgian authorisation. 

The announced restoration of Curaçao’s licensing portal therefore does not change this fundamental rule. Even when the register is available again and digital seals function correctly, a separate check of the Belgian licence remains necessary. 

An accessible gambling website is not necessarily a licensed one 

For players, website accessibility and legality can easily become confused. A website loads, a registration form appears and a licensing logo is displayed at the bottom of the page. This may create the impression that everything is in order for the Belgian market. 

Gambling Club previously investigated how illegal gambling websites can remain accessible despite blocking measures. That article explains why technical access is not a reliable indicator of whether an operator is authorised in Belgium. 

The CGA case raises another question: what exactly does a licensing register tell you? A register may show that a company holds a licence issued by a particular regulator. It does not grant blanket permission to operate in every country where its website can be accessed. 

Nor does this data breach prove that the player databases of every Curaçao-licensed casino have been hacked. The incident described concerns the regulator’s licensing portal. Without additional findings, no general conclusion can be drawn about the systems operated by all the gambling companies involved. 

The next steps should provide greater clarity 

The CGA has now announced legal, technical and organisational measures. The criminal complaints, removal requests and transition to a different portal demonstrate the wide-ranging consequences of the incident. 

What is still missing is a complete picture of the affected data and the findings of the independent investigation. It also remains to be seen which concrete improvements will be introduced to prevent a recurrence and how affected parties will be informed. 

For Belgium, this is primarily a case that deserves continued scrutiny. It raises questions about transparency surrounding international gambling companies, the protection of confidential information and the limits of foreign licences. Ultimately, restoring trust will require demonstrable improvements and verifiable answers.