Must Read Data Breach at the Curaçao Gaming Authority (CGA)

[Webzcas]

I have just received an email concerning a data breach at the Curaçao Gaming Authority.

Posted below:

IMPORTANT: CGA Data Breach​

Dear Client,

We wish to draw your attention to a reported data breach involving the Curaçao Gaming Authority (CGA).

The CGA has confirmed that it is investigating unauthorised access to its online gaming portal. A substantial volume of confidential licensing and corporate information has subsequently been made publicly accessible online.

If you have previously submitted information to the CGA, we strongly recommend that you assess your potential exposure, including information relating to your company, directors, shareholders and UBOs.

We also advise against downloading documents from the published database. Files obtained from an untrusted source may contain malware or other malicious content. If documents need to be obtained for review, they should be handled and vetted by an appropriately qualified IT or cybersecurity professional before being opened or circulated.

Please also remain alert to phishing, impersonation and other targeted attempts using information that may have originated from the leaked documentation.

...

 

[Wait!What?]

Definitely the guys from Anjouan.

 

[Valge]

For those who missed this, here's what happened.

On September 17, the CGA confirmed that unauthorised users had accessed its online gaming platform. Since then, the source has been found and the breach has been contained. The CGA has promised to notify impacted licensees and stakeholders directly once the entire scope of the ongoing forensic investigation has been determined.

As of right now, it is known that the access was available for around nine months. It was created by a German security researcher who has worked with other gaming regulators on similar initiatives. She felt that the public was interested in knowing who owns Curaçao-licensed businesses, thus she made records public. According to Curaçao legislation, the incident is a significant violation, and the CGA plans to submit it to the appropriate authorities.

Where regulation allows it, one way to distribute and reduce this kind of exposure is through a sub-licence or licensed white-label arrangement. Meaning your partner's security and compliance standards matter just as much as your own.

Also, avoid downloading documents from published databases. Files most likely carry a malware risk.

 

[teckiwi]

Theres certainly alot of info said to be available in the initial leak(more to come as I understand it), the crypto transactions for some casinos could lead to the US taking action against some platforms that opt to serve US players sending funds to exchanges in reach of the US Gov etc. Will be interesting times ahead.

 

[Valge]

A few things have moved on the CGA situation since the last update.

On the leaked data: CGA has brought in specialist takedown companies and notified authorities in Curaçao, Germany and the Netherlands. A civil claim against those responsible is being considered. No timeline on how long the takedowns will take — and realistically, once data like this is out, full removal from the internet is unlikely.

On the new portal: the temporary replacement was supposed to go live October 19. The page exists and is accessible by invitation, but there’s no public confirmation yet that it’s fully operational and tested. Long term, the plan is for CGA to build and run its own internal system. The old portal and its provider are gone permanently.

What hasn’t changed: existing licences are still valid, operator obligations still apply, supervision continues. The breach hit the infrastructure, not the licences.

The political side: MAN party leader Giselle Mc William’s demand for the CGA director to resign hasn’t gone away. Separate from the technical recovery, it's worth keeping an eye on if you’re tracking how this affects Curaçao’s regulatory credibility longer term.

 

[dunover]

A few things have moved on the CGA situation since the last update.

On the leaked data: CGA has brought in specialist takedown companies and notified authorities in Curaçao, Germany and the Netherlands. A civil claim against those responsible is being considered. No timeline on how long the takedowns will take — and realistically, once data like this is out, full removal from the internet is unlikely.

On the new portal: the temporary replacement was supposed to go live October 19. The page exists and is accessible by invitation, but there’s no public confirmation yet that it’s fully operational and tested. Long term, the plan is for CGA to build and run its own internal system. The old portal and its provider are gone permanently.

What hasn’t changed: existing licences are still valid, operator obligations still apply, supervision continues. The breach hit the infrastructure, not the licences.

The political side: MAN party leader Giselle Mc William’s demand for the CGA director to resign hasn’t gone away. Separate from the technical recovery, it's worth keeping an eye on if you’re tracking how this affects Curaçao’s regulatory credibility longer term.

Oh, the irony! Curacao considering taking legal action as the wronged party.

My heart bleeds for the scam-enabling w*nkers.