Following the data compromise, Curaçao Gaming Authority is in damage limitation mode.

Following the data compromise, Curaçao Gaming Authority is in damage limitation mode.

Following a widely reported data theft by German hacker Lilith Wittman, the Curaçao Gaming Authority (CGA) has filed complaints in three countries.

Following Wittman's access to the CGA's web portal between December 2025 and September 2026, thousands of records pertaining to the ownership structure of Curaçao-licensed corporations were made public, and complaints were filed in Germany, the Netherlands, and Curaçao.

In a series of essays published in several European languages in 2024, she claimed that the CGA had disregarded significant issues pertaining to the leadership of different operators while awarding licenses as part of the implementation of LOK.

Her activities were deemed "criminal conduct" by the CGA, which also stated that it has hired specialized firms to remove the information from the internet and is contemplating civil litigation.

In order to determine the impact and repercussions of the attack and to find ways to enhance its systems, it has also started an inquiry.

"As more information is handled digitally, organizations around the world face the risk of hacking and data breaches," the regulator said in a statement. This does not lessen the gravity of what transpired at CGA. It demonstrates why ongoing attention to digital security is necessary. CGA must minimize the harm and apply the investigation's conclusions to enhance its operational procedures and security. 

The CGA pulled its web portal offline once the breach was discovered, and it has since stated that it is creating a new platform to replace the compromised one, with a temporary fix anticipated in the interim.

But according to the CGA, it won't be active until security testing is done to find any potential flaws and make sure it functions effectively for stakeholders.

The CGA responded to Wittman's accusations by stating that since taking over as the jurisdiction's supervisor in 2024, it has adhered to "robust internal procedures in performing due diligence."