Curaçao's Gaming Authority Relaunches Its Licence Register After the Portal Breach: What the October 20 File Shows
From a Breach in December to an Interim Portal in October
In a press release dated October 19, 2026 the Curaçao Gaming Authority (CGA) confirmed that a security researcher based in Germany accessed its online gambling licensing portal without permission between December 2025 and September 2026, and that data belonging to licence holders was taken and published. The regulator discovered the intrusion on September 17, took the portal offline and on October 7 announced that it would not return.
The October 7 notice made two points that matter to anyone who checks a casino's licence before depositing: existing licences stay valid, and the digital seal that operators embed in their footers would be affected, with an alternative mechanism promised. The interim portal, scheduled for October 19, is announced on the CGA site as launched that day, with the licence register and the seal system due to return with it after independent security checks. On October 20 the register PDF on the CGA website was refreshed.
| Date | What the CGA published |
|---|---|
| December 2025 | Start of the unauthorised access to the licensing portal, per the October 19 press release |
| September 17, 2026 | Intrusion discovered; internal investigation and added security measures, then the portal taken offline for an external investigation |
| October 2, 2026 | Portal confirmed offline; documentation deadlines postponed until it returns; submissions by email not accepted |
| October 7, 2026 | Portal will not be returned to service; provider arrangement concluded; existing licences remain valid; availability of the digital seal affected |
| October 19, 2026 | Interim portal launched, with the licence register and digital seal scheduled to return alongside it; press release on the breach published |
| October 20, 2026 | Online gaming licence register PDF refreshed on cga.cw |
Source: CGA announcements of October 2, 7 and 19, 2026 (PDF) and the CGA licence register page, read October 28, 2026.
What the October 20 Register Contains
The refreshed register is a 19-page PDF with 591 entries. Each gives a licence number, the licensee, the company registration number, an issue date, an expiry date and a status. Two things stand out.
First, a new numbering scheme has arrived. 572 entries carry the familiar OGL/2023 or OGL/2024 prefix. Nineteen carry a CGA/2025 prefix, with issue dates between August 9 and October 20, 2026 and expiry dates six months later, in 2027.
Second, the status column. 209 entries are marked Indefinite, the status the register gives to licences with no expiry date. 298 are marked Assessment in progress, which in this file sits on entries whose listed term has already ended. 54 are marked Expired, four say Assessment in re-evaluation, and one is Expired with the note "re-evaluating in administrative appeal". The file separates 511 B2C operator licences from 80 B2B supplier licences.
The enforcement register on the same page still carries a September 14 date, so the licence register is the only file refreshed since the breach was disclosed.
27 Tracked Brands, 25 Licence Numbers, Three Statuses
We matched the file against the 27 brands in our tracked database of crypto casinos that publish a Curaçao licence number on their own site. They share 25 distinct numbers, because two pairs of sister brands operate under one licence each. All 25 numbers appear in the October 20 register, so no tracked brand's licence disappeared in the move to the interim portal.
The statuses are not uniform. Eighteen brands, among them BitStarz, Roobet, Shuffle, Bitcasino and TrustDice, sit on a licence marked Indefinite. Seven are on licences whose term has ended and that the register marks Assessment in progress. Two are on licences marked Expired, one of them with the administrative-appeal note.
| Brand | Licence (licensee) | Status, October 20 register |
|---|---|---|
| Stake | OGL/2024/1451/0918 (Medium Rare N.V.) | Assessment in progress; term ended Jun 9, 2026 |
| Cloudbet | OGL/2024/328/0599 (Halcyon Super Holdings B.V.) | Assessment in progress; term ended May 23, 2026 |
| HypeBet | OGL/2024/985/0430 (BlackSands B.V.) | Assessment in progress; term ended Jun 16, 2026 |
| LetsGo | OGL/2024/1113/0517 (Progress Path Co N.V.) | Assessment in progress; term ended Jul 24, 2026 |
| Izzi | OGL/2024/570/0396 (Carrer N.V.) | Assessment in progress; term ended Jun 2, 2026 |
| OnlyWin | OGL/2024/589/0556 (GBL Solutions N.V.) | Assessment in progress; term ended Apr 14, 2026 |
| Casino Brango | OGL/2024/1274/0819 (Anden Online N.V.) | Assessment in progress; term ended Aug 27, 2026 |
| Imperial Wins | OGL/2024/284/0863 (ABC Interactive N.V.) | Expired; term ended Dec 24, 2025 |
| Rollbit | OGL/2024/1260/0494 (Bull Gaming N.V.) | Expired, re-evaluating in administrative appeal; term ended May 23, 2026 |
Source: CGA online gaming licence register PDF dated October 20, 2026, matched to the licence numbers each operator publishes on its own site, as recorded in our tracked database of crypto casinos.
An expired or in-assessment entry is not a revoked one; revocations live in the enforcement register. What the status column tells a player is whether the regulator has finished reviewing that licensee's term, and for nine of 27 tracked brands it has not.
Why the Seal Is Not the Check
Most Curaçao-licensed casinos display a clickable footer seal that opens a validation page on a CGA domain. The October 7 notice said the seal's availability would be affected, and the October 19 release listed the seal system among the components returning with the interim portal. A seal that loads says only that a domain is linked to a licence number, not what status that number carries.
The register PDF is the stronger check. It names the licensee company and shows the term and the status. Its weak spot is that it lists companies rather than domains, so the licence number or company name has to come from the casino's own terms or footer. The register page also warns that the overviews "do not guarantee the current validity of the licenses", which is the regulator's way of saying that the status column, not the mere presence of a number, is what to read.
The October 19 release adds that the CGA has hired 14 staff for licensing, supervision and enforcement since 2024 and intends to build and run the replacement portal itself. The LOK, the law behind the reform, turns two on December 24, 2026.
What It Means for Canadian Players
A Curaçao licence that was valid before September remains valid; the CGA has said so in three separate notices. But the licence a casino quotes may be one whose term has ended and whose renewal is being assessed, and the register is the only public place that shows this.
- Take the licence number or company name from the casino's own terms page, not from a third-party review, and find it in the register PDF on cga.cw.
- Read the status column. Indefinite means no expiry date is listed. Assessment in progress means the listed term has ended and the regulator is reviewing. Expired means what it says, and an appeal note means the decision is being contested.
- Treat a working seal as a pointer to the register rather than a verdict, and a missing one as uninformative until the CGA's replacement mechanism is confirmed.
- Curaçao licensing does not change the Canadian picture: Ontario and Alberta require provincial registration, and a Curaçao licence confers no standing with the AGCO or the AGLC.
Each review in our database records the licence number and the register status on the date it was checked, so a change of status shows up as a dated correction in the review's changelog.
Sources
CGA — Press release: Data breach at CGA, from investigation to action (October 19, 2026)- CGA — CGA to transition to a new regulatory platform (October 7, 2026)
- CGA — Licence registers page with the online gaming licence register PDF of October 20, 2026