German security researcher and activist Lilith Wittmann says the Berlin Regional Court II has ruled she can use documents she obtained from a March breach of Malta Gaming Authority (MGA) systems. The decision came in injunction proceedings brought against her by the MGA and its CEO, Charles Mizzi.
The same ruling bars her from accessing MGA systems again, according to Wittmann, who announced the outcome on X on 25 September. The judgment in case 7 O 254/26 eV, including the court’s written reasoning, has not been published.
What the ruling allows
Wittmann said the decision also lets her keep describing the MGA as an “organised crime enablement scheme”. At a hearing on 10 September, she said, the judge treated her statements on the subject as permissible expressions of opinion, not false statements of fact.
The ruling does not establish that the MGA enables organised crime. Under German law, value judgments are broadly protected as free expression, while false statements of fact can be prohibited. Wittmann’s account indicates the court placed her wording in the first category.
The MGA and Mizzi first secured an injunction against Wittmann in Germany. She challenged the order, which led to the latest decision. The MGA was represented by law firm Bird & Bird, according to SiGMA.
Wittmann has called the case a strategic lawsuit against public participation (SLAPP). She said it produced around 2,000 pages of court files and cost her between €15,000 and €20,000 in legal and court fees.
The March breach
Wittmann has previously reported flaws in Germany’s gambling regulatory systems and security weaknesses in political and government IT. In March she said she had gained access to MGA systems and had shared the data with media partners and authorities. The MGA confirmed a system breach at the time.
Her post announcing the breach addressed the regulator directly:
“And yes, we will expose the organised crime enablement schemes you created while presenting yourselves as a ‘legitimate public service.'”
In a statement reported by Next.io, the MGA said its legal action was intended to prevent further unauthorised access and protect information entrusted to it, and denied acting in response to criticism. The regulator said it is analysing the court’s decision and its implications. It has not said whether it will appeal.
Curaçao regulator files go public
The Berlin ruling came days after Wittmann published more than 40,000 documents obtained from the Curaçao Gaming Authority (CGA), which took over licensing when the National Ordinance on Games of Chance (LOK) came into force in December 2024. She released them under the name “Casino Secrets”.
The archive holds material from operators’ licence applications: ultimate beneficial owner (UBO) and ownership details, corporate structures, source-of-wealth and funding records, business plans and due-diligence files. It also contains the CGA’s internal reviews and the conditions it set for individual licences.
Wittmann said she had access to CGA systems for about nine months. The CGA confirmed unauthorised access, said the incident had been contained and said a forensic investigation is under way, according to SiGMA.
Domain suspended, archive moved
On 25 September, the day she announced the Berlin ruling, the searchable database at casinosecrets.lol stopped resolving. Registry records showed the domain on “server hold”. Wittmann said registry operator XYZ took the site down before Cloudflare could act.
Within hours she moved the archive to curacaofiles.com, where it remains publicly accessible.
Earlier that day, Wittmann said the pending MGA litigation made publishing new Casino Secrets material legally risky. She said an adverse ruling could have exposed her to penalties of up to €250,000 or six months’ detention for breaching the injunction. Those are the maximum sanctions German civil procedure allows per breach of a court order.
What comes next
The court’s written reasons, once released, will set out the legal basis for letting Wittmann use the Maltese material. The MGA is still reviewing the decision, and an appeal would keep the injunction dispute open.
In Curaçao, the CGA’s forensic investigation continues while ownership, funding and due-diligence files that licence applicants submitted to the regulator remain publicly searchable.
Source: Lilith Wittmann
