Berlin court backs researcher Wittmann in Malta Gaming Authority case
A Berlin court has ruled in favour of security researcher Lilith Wittmann in the Malta Gaming Authority's injunction bid, her account says, as her Casino Secrets leak site went offline.
Key points
- Wittmann said the Landgericht Berlin II judgment lets her keep using MGA documents and calling the regulator an organised crime enablement scheme.
- She said the court barred her from accessing MGA systems again; the full judgment has not been published.
- The case follows her March 2026 breach of an internal MGA system, separate from the Curaçao breach behind Casino Secrets.
- Registry records show casinosecrets.lol was placed on server hold at 12:05 UTC on Friday; the database moved to curacaofiles.com.
- Wittmann said the case ran to about 2,000 pages and cost her 15,000 to 20,000 euros in legal fees.
A Berlin court has ruled in favour of security researcher Lilith Wittmann in an injunction case brought by the Malta Gaming Authority, according to her own account of the outcome. Wittmann, who is based in Berlin, announced the result on X on Friday. She said she may keep using documents taken from the regulator's systems and may keep describing the MGA as an organised crime enablement scheme. She also said the court barred her from accessing those systems again.
A screenshot of the judgment's first page, posted by Wittmann, identifies the case as 7 O 254/26 eV at the Landgericht Berlin II, issued in interim injunction proceedings. The applicants are the Malta Gaming Authority, represented by chief executive Charles Mizzi, and Mizzi himself, with Bird & Bird LLP acting for both. The operative part of the ruling is not shown and the full judgment has not been published, so the outcome rests on Wittmann's account.
The dispute stems from Wittmann's breach of an internal MGA system in March 2026. That intrusion is separate from the Curaçao breach behind Casino Secrets, a site revealing the inner regulatory workings of Curaçao-based online casinos and the licensing process. The Maltese regulator obtained an interim injunction against her, which she said targeted her public claims that it enables organised crime and sought to prevent further access to its systems. She contested it, and the court heard her objection on Sept. 10.
Court ruling in Berlin
Wittmann has called the case a SLAPP, the acronym for a strategic lawsuit against public participation, meaning a lawsuit meant to silence criticism. She said it had run to roughly 2,000 pages of court documents and cost her between 15,000 and 20,000 euros in legal fees, or about $17,000 to $22,700 at Sept. 24 rates. She said a loss could have exposed her to a penalty of 250,000 euros, about $284,000, or six months in prison, which made this week's publications risky. Of the hacking itself, she wrote that it is something she has no intention of doing again soon.
Hours after the verdict, the archive's original address went offline. Registry records show casinosecrets.lol was placed on server hold, a suspension applied at registry level, at 12:05 UTC on Friday. Wittmann said the .lol registry, XYZ, had moved faster than Cloudflare. She had questioned earlier in the week whether Cloudflare would keep the site online, saying most of the illegal casinos are its customers. The leaked database is now live at curacaofiles.com, a domain registered in December 2025, and is still served through Cloudflare.
The Maltese regulator oversees 311 active licensees, according to Next.io, and Malta's iGaming shield has been repeatedly challenged in German-facing disputes this year. The EU's top court ruled in April that a German player can reclaim losses from a Malta-licensed operator, and an Advocate General called Malta's law shielding its operators from foreign judgments manifestly incompatible with EU rules. Wittmann has used roughly 3,000 documents from the MGA's systems in her reporting, including filings she says identify the owner behind Platincasino, the brand at the centre of her German investigation.
Leak site goes offline
Frankfurt prosecutors searched 11 properties and arrested a main suspect on Sept. 8 over alleged illegal online gambling involving about 5.86 billion euros, or $6.66 billion, in stakes, without naming the casino; Wittmann's reporting links the case to Platincasino. The Malta Gaming Authority has not commented publicly on the ruling. Its Curaçao counterpart, which tightened its rules for crypto casinos in June and whose portal Wittmann accessed from December 2025 to September 2026, called that breach a serious breach under Curaçao law in a Sept. 22 statement and said it would report it to the relevant authorities. Searchable records from the Curaçao files went online on Wednesday, as the named companies and the regulator pushed back against the findings.