Curaçao gambling regulator hacked, crypto casino users fear data exposure
What happened
Curaçao's gambling regulator, the Curaçao Gaming Authority (CGA), announced on September 17 that hackers had accessed its online gaming portal. The CGA said it contained the unauthorized access but has not yet determined the full scope of the breach.
The regulator stated it is assessing whether and which information was accessed and what the potential consequences may be. It also said it will directly notify affected individuals, applicants, licensees, or other stakeholders if the hack impacts them.
Why crypto casinos are involved
Curaçao has become a popular location for online casinos because of its relaxed gambling laws under the CGA. Crypto casinos such as Rollbit, 1xBet, and Stake are registered there. Users on the social media platform X have speculated that the hackers may have obtained sensitive data belonging to crypto casino operators, including photo IDs and other personal information.
These users believe the stolen data could potentially be leaked or used by criminals for extortion. However, this remains speculation — the CGA has not confirmed what data was compromised.
What the CGA has said
The CGA stated: "While the unauthorized access has been contained, the investigation remains ongoing and has not yet established the full scope of the incident." The regulator added that it is currently evaluating what information may have been accessed and the potential consequences.
The CGA said it will directly notify anyone affected if the breach impacts them.
What is still unclear
The CGA has not revealed what specific information was accessed or how many people or companies were affected. It is also unclear whether any crypto casino operator data was actually compromised. The speculation about doxxing comes from users on X and is not confirmed by the regulator.
Broader context
Curaçao's gambling regulator is known for carrying out only minimal checks on casinos applying for licenses. Rollbit's Curaçao license appears to have been revoked earlier in September 2026, though the platform reportedly continued operating. The nation also attempted to improve its gambling reputation this year by introducing new legislation requiring transparent anti-money laundering and identity verification procedures.
Why this matters
If the personal data of crypto casino operators was indeed stolen, it could put those businesses and their users at risk of extortion or identity fraud. The incident also raises questions about the security practices of a regulator that oversees a large number of online gambling operations, including those in the crypto space.
What happens next
The CGA investigation is ongoing. The regulator has pledged to notify affected parties directly. It remains to be seen whether the full details of the breach will be made public and what actions will follow.