jili tutorial

Hacker Wins Court Battle Against Malta Gaming Authority: Inside the Casino Secrets Leak and SLAPP Ruling

By jili tutorial · September 28, 2026

Hacker Wins Court Battle Against Malta Gaming Authority: Inside the Casino Secrets Leak and SLAPP Ruling

Overview of the Case

On September 25, German activist and white-hat hacker Lilith Wittmann announced a significant legal victory in her ongoing confrontation with the Malta Gaming Authority (MGA). The Berlin Regional Court II ruled that she may continue using documents obtained from a prior hack of the MGA’s systems and is permitted to describe the regulator as an “organized crime enablement scheme” — provided she does not access those systems again. The ruling coincided with the publication of over 40,000 documents from the Curaçao Gaming Authority (CGA), part of Wittmann’s “Casino Secrets” investigation, which was briefly taken offline but quickly restored.

This article delves into the facts of the case, the background of the activist, the nature of SLAPP lawsuits, and the broader implications for gambling regulation and transparency.

Who Is Lilith Wittmann? Background and Previous Investigations

Lilith Wittmann is a German security researcher and activist known for exposing vulnerabilities in government IT systems and regulatory bodies. Her previous work includes:

Her methods combine ethical hacking (gaining authorized or unauthorized access to expose flaws) with data journalism. She frequently collaborates with media partners and authorities to share findings, positioning herself as a whistleblower rather than a malicious actor.

The Berlin Court Ruling: Key Details and Implications

What the Court Decided

The Berlin Regional Court II issued a judgment that:

What the Ruling Does Not Do

The MGA and its CEO, Charles Mizzi, had sought an injunction in Germany after Wittmann announced she had breached their systems and shared data with media partners and authorities. In a public statement at the time, Wittmann declared:

“And yes, we will expose the organised crime enablement schemes you created while presenting yourselves as a ‘legitimate public service.’”

The regulator labeled the hack as illegal and pursued legal remedies. Wittmann countered by characterizing the lawsuit as a SLAPP (Strategic Lawsuit Against Public Participation).

Understanding SLAPP Lawsuits and Their Role in This Case

A SLAPP is a lawsuit filed with the primary goal of silencing critics, often by imposing heavy legal costs and intimidation rather than winning on the merits. Typical features include:

In this case, Wittmann argued that the MGA’s injunction was a SLAPP designed to prevent her from publishing her Casino Secrets findings. The Berlin court’s decision to allow her opinion-based statements suggests that at least some of her claims are protected under free speech, even if the underlying intrusion remains legally questionable.

The Casino Secrets Investigation: Curaçao Documents Leak

The Curaçao Gaming Authority (CGA)

The CGA is one of the world’s most widely used offshore gambling regulators, granting licenses to thousands of operators. Critics have long accused it of weak oversight, allowing money laundering and other illicit activities. The leaked documents provide unprecedented transparency into its operations.

What the Documents Contain

Wittmann’s “Casino Secrets” database includes over 40,000 files from operators’ license applications, such as:

Researchers, journalists, and the public can now search and analyze this data to identify potential conflicts of interest, shell companies, and patterns of regulatory failure.

Wittmann published the Curaçao documents on the same week as the Berlin ruling. She had previously warned that the unresolved MGA litigation made this publication risky: an adverse ruling could have exposed her to penalties of up to €250,000 or six months’ detention for violating an injunction.

Domain Disruption and Resilience

The Initial Takedown

Hours after Wittmann announced the Berlin ruling, the website hosting the searchable Curaçao database — casinosecrets.lol — was knocked offline. Registry records showed the domain was placed on “server hold” by domain operator XYZ, preventing it from resolving.

Wittmann stated that XYZ deplatformed the site before Cloudflare, a content delivery network, could act. She implied that pressure from the gambling industry or affected parties may have motivated the takedown.

Quick Recovery

Within hours, Wittmann migrated the archive to a new domain: curacaofiles.com. As of publication, the site remains publicly accessible, containing the full dataset. This move demonstrates the resilience of distributed data and the difficulty of fully suppressing leaked information once it enters the public domain.

Risks and Costs Faced by Wittmann

Wittmann revealed that the legal battle generated approximately 2,000 pages of court documents and cost her between €15,000 and €20,000 in legal and court fees. This financial burden is a common tactic in SLAPP lawsuits, intended to drain resources and discourage further reporting.

Despite these costs, she continues to publish findings, underscoring the high personal stakes for whistleblowers who challenge powerful regulatory bodies.

Broader Impact on Gambling Regulation and Transparency

Malta Gaming Authority (MGA)

The MGA is one of Europe’s most prominent gambling regulators, licensing many major online operators. Wittmann’s allegations of organized crime enablement, even if not yet proven in court, have already damaged its reputation. The Berlin ruling allows her to continue making that claim as opinion, which may fuel further investigative scrutiny.

Curaçao Gaming Authority (CGA)

The flood of documents from Curaçao threatens to expose systemic weaknesses in offshore licensing. Law enforcement, journalists, and watchdog groups can now cross-reference operator information with global databases of sanctions, politically exposed persons, and criminal investigations. This could lead to:

What’s Next? Unresolved Questions and MGA’s Silence

As of the report, the MGA has not publicly commented on the Berlin judgment. It remains unclear whether the regulator will appeal or pursue further legal action in other jurisdictions.

Meanwhile, Wittmann has signaled she will continue her investigations. The domain disruption highlights the ongoing battle between transparency advocates and entities that wish to suppress information. The legal precedent in Germany may also affect how other European courts treat similar cases involving hacked data and public interest reporting.

Conclusion

Lilith Wittmann’s dual victories — the Berlin court ruling and the successful publication of the Curaçao documents — mark a significant moment in the ongoing struggle for transparency in international gambling regulation. While her methods remain controversial, the legal recognition of her right to express opinion offers some protection for whistleblowers, even as they face formidable legal and financial challenges. The MGA and CGA will likely face increased scrutiny in the months ahead, as the leaked data continues to be analyzed and new questions arise about the integrity of the licensing systems.