Curacao Gaming Authority leak and what a casino license still proves

Certificates still live   Published , updated

Curacao license checks still work after the September 2026 leak, and no permit was cancelled by the reporting. What the published files call into question is ownership, namely who really stands behind the licensed companies and how closely the regulator looked before issuing permits. The certificate search remains the way to confirm that a casino holds a current Curacao license for the domain you are on, so use it for that and judge ownership separately.

What happened to the CGA licensing portal

Unauthorized access to the Curacao Gaming Authority online gaming portal was confirmed by the regulator itself in a press release dated 17 September 2026. The CGA said the access had been contained and its source identified, that a forensic investigation was under way, and that the full scope of the incident was not yet established. It added that no compromise of its core technical infrastructure had been identified at that stage, and that affected applicants and licensees would be notified directly.

Five days later, on 22 September 2026, Follow the Money published an investigation called Casino Secrets together with NRK in Norway, NDR in Germany, Jetzt in Austria and SVT in Sweden. It is based on documents taken from that portal, and it connects roughly 800 owners to nearly 650 licensed gambling companies. The reporting says the authority granted permits in cases where questions about the beneficial owners had not been answered.

How the CGA responded in October 2026

The regulator closed the breached system for good. On 7 October 2026 the CGA announced that its online gaming portal would not be returned to service and that the service arrangements behind it would end. It warned that the availability of the current digital seal would be affected and promised another way for operators to show that a domain is licensed. A temporary portal was scheduled for 19 October.

The same day, 19 October, the authority published a longer press release. It had filed complaints and reported the incident to authorities in Curacao, Germany and the Netherlands, and hired specialist companies to remove the leaked information from the internet. An independent technical investigation is under way and civil legal action is being considered. The release adds that an external company ran the old portal and its database. Our news post on the Curacao Gaming Authority data breach has the full timeline.

Regulator statement
17 September 2026, unauthorized access to the online gaming portal
Investigation published
22 September 2026, by Follow the Money with NRK, NDR, Jetzt and SVT
Scale reported
Around 800 owners across nearly 650 licensed companies
System affected
The licensing portal used for filings, not the public certificate search
Licenses withdrawn
None as a result of the publication
Old portal
Closed for good on 7 October 2026, temporary portal scheduled for 19 October
Legal steps
Complaints in Curacao, Germany and the Netherlands, takedown firms hired, announced 19 October 2026

What the leak changes for a license check

The certificate pages on cert.cga.cw are a different surface from the filing portal, and each still shows a live Certificate of Operation naming the operator, the license number, the grant date, the covered domains and the current status. One thing changed after the story ran. Since 30 September 2026 the public search page at cert.cga.cw/search returns a page-not-found error, so a check now starts from the seal on the casino site. Each licence also keeps its own page at cert.cga.cw/token?id= followed by the last part of the licence number, showing the licence status and the domains approved under it. Our Curacao license page has the updated steps.

What changes is the weight a reader should put on the result. A Curacao certificate has always been a statement about registration and supervision. The reporting is a reminder that it was never a statement about ultimate ownership, and that the vetting behind it varied.

Question about a casinoCan the CGA register answer it?
Does a current license cover this exact domain?Yes, the certificate lists the certified domains
Which legal entity holds the license?Yes, the operator and company number are named
Is the license active right now?Yes, the status appears on the live certificate
Who ultimately owns the licensed company?No, beneficial ownership is not published
How thoroughly was that ownership verified?No, and this is the point the 2026 reporting raises
May the casino accept players from my country?No, that depends on the rules where you live

A licensed company can still be an illegal operator elsewhere

One case in the reporting shows the gap plainly. Novatech Solutions N.V., the company behind Qbet.com and 55Bet.com, was fined 24,846,000 euro by the Dutch Kansspelautoriteit for offering gambling to players in the Netherlands without a Dutch permit. The decision was taken on 16 December 2025 and published on 10 March 2026. A valid offshore license and an enforcement action in a regulated market can describe the same company at the same time, which is why the question that matters to a player is whether an operator may lawfully serve their own market.

How to check a Curacao casino right now

  1. Click the CGA seal on the casino site. A genuine seal opens a Certificate of Operation on cert.cga.cw. The CGA warned on 7 October 2026 that the seal may be unavailable for a while, so if it does not open, go straight to the licence number in step 4.
  2. Confirm the certificate is live, that the status reads active, and that your exact domain appears in the certified list.
  3. Match the operator named on the certificate against the company named in the casino terms and conditions.
  4. If the casino shows its license number, open cert.cga.cw/token?id= followed by the last part of that number, for example id=1016 for OGL/2024/1769/1016, and check the license status and the approved domains.
  5. Treat the license claim as unverified if the site has no seal, or the seal is a flat image or opens another domain.
  6. Check your own country's regulator, because a Curacao license says nothing about whether the operator may serve you.

The full procedure, the register links and the red flags specific to this jurisdiction are on the Curacao page. The general method for any regulator is in our guide on how to check a casino license.

Our position on the leaked documents

We do not use them. Our Curacao data comes from the public certificate search and from published regulator decisions, and it always has. The leaked files contain passports, tax returns and personal financial records belonging to named individuals, and republishing that material is not something an independent reference should do. Everything on this page is drawn from the regulator's own press release, from the published investigation and from the Dutch penalty decision, all linked below. Our methodology explains where every record on this site comes from.

Frequently asked questions

Was the Curacao license register hacked?

No. The unauthorized access the CGA confirmed on 17 September 2026 concerned its online gaming portal, the system licensees and applicants use to file documents. The certificate pages on cert.cga.cw are a separate surface and still open live Certificates of Operation. Since 30 September 2026 the public search page there returns a page-not-found error, so a check now starts from the seal on the casino site or from the page each licence has on cert.cga.cw, which lists the domains approved under it.

Does the leak cancel any Curacao gambling license?

No. The reporting concerns how licenses were granted and who stands behind the licensed companies. No permit was withdrawn by the publication. License status is still settled by the certificate in the CGA register and nowhere else. On 7 and 19 October 2026 the CGA repeated that closing its old portal does not invalidate existing licenses.

What is the CGA doing about the leaked documents?

In a press release dated 19 October 2026 the CGA said it had filed complaints with authorities in Curacao, Germany and the Netherlands and hired specialist companies to remove the information available on the internet. It also commissioned an independent technical investigation and is considering civil legal action. On 7 October it said the old licensing portal would not return to service.

What does a Curacao license actually prove?

It proves that a named legal entity holds a current permit from the Curacao Gaming Authority for named domains, and that the entity is subject to the conduct rules of the LOK. It is not a finding about who ultimately owns that entity, and the September 2026 reporting says ownership questions were sometimes left open when licenses were granted.

How should a player read a Curacao license after the leak?

Use it to rule out the obvious problem, which is a casino with no license at all or a license that does not cover the domain you are on. Then judge the operator on things the register does not cover, such as published terms, complaint handling and whether the casino is permitted to accept players from your country.

Sources