Key Points
- Wittmann says interim proceedings in case 7 O 254/26 eV at Berlin Regional Court II went in her favour, though the full judgment has not been published and the outcome rests on her account alone.
- The MGA, represented by Bird & Bird LLP, had sought to prevent her from linking it to organised crime and from re-entering its systems; Wittmann says the court allowed the former and only blocked the latter.
- Days after the ruling was reported, the Curaçao Gaming Authority confirmed it is considering separate legal proceedings against Wittmann over the 40,000-document Casino Secrets breach.
What Wittmann Says the Berlin Court Decided?
A Berlin court has reportedly ruled against the Malta Gaming Authority’s bid to silence one of its most disruptive critics. On 25 September, Lilith Wittmann posted a screenshot on X of the first page of a judgment in case 7 O 254/26 eV at the Landgericht Berlin II, listing the MGA and its CEO Charles Mizzi as applicants, with Bird & Bird LLP acting for both from its Frankfurt office.
Wittmann’s post read: “Just received the verdict in Malta Gaming Authority v. Wittmann. Good news: I can call the MGA an organised crime enablement scheme, and use the documents I obtained. Bad news: I’m not allowed to hack them again. #casinosecrets”
The judgment itself has not been published. NEXT.io explicitly noted that all information about the case’s outcome comes from Wittmann, and the screenshot she published shows only the first page, not the operative order or the court’s reasoning. The full legal implications cannot yet be assessed independently, and the reported outcome should not be read as a court finding that the MGA enables organised crime.
What the screenshot does confirm is that this was an interim injunction proceeding, a provisional remedy under German civil procedure, not a final ruling on the truth of the underlying allegations.
Six Months of Legal Pressure, and the Bill Wittmann Paid
The dispute traces back to March 2026, when Wittmann publicly claimed responsibility for breaching an internal MGA system and announced plans to expose what she called organised crime links within Malta’s iGaming sector. The MGA, through Bird & Bird LLP, subsequently obtained a preliminary injunction against her in Germany.
According to Wittmann, the court papers across the full proceedings ran to roughly 1,300 pages, which she says grew to around 2,000 pages of total court files by the time the September ruling arrived. She also said the litigation cost her between €15,000 and €20,000 in legal fees, describing the proceedings on LinkedIn as “a pretty SLAPP to hang on the wall,” using the term for strategic lawsuits against public participation.
The MGA told NEXT.io it “rejects any suggestion that these measures were intended to intimidate, silence or discourage reporting,” insisting its actions were “protective in purpose and directed at preventing further unauthorised conduct.” The authority added it had sought no damages or monetary relief and was still analysing the court’s decision before commenting on third-party characterisations of the ruling.
The Documents Already Driving Real Investigations
The significance of the reported ruling is not abstract. Wittmann says she extracted roughly 3,000 documents from the MGA’s licensing portal and has already used them extensively in the Casino Secrets investigation, coordinated across NDR, NRK, SVT, and Dutch outlet Follow the Money.
The most consequential thread so far involves Platincasino. Wittmann’s investigation identifies a company operating under MGA licence MGA/CL1/1364/2017 with a single named beneficial owner in the MGA’s records. In 2023, Platincasino’s brand, domains, and player database were transferred from Malta to a Curaçao entity for a reported €6 million. Wittmann estimates approximately €250 million in German gambling tax may not have been paid between 2023 and 2025, though this remains her estimate based on inferred player figures and is not an established official loss figure.
Separately, German prosecutors are investigating five suspects over alleged illegal online gambling with approximately €5.86 billion in stakes processed between July 2021 and the end of 2023, covering a different period and measuring stakes, not revenue or tax. Germany’s gambling regulator, the GGL, has explicitly warned consumers against participating in illegal offers “such as Platincasino” in connection with that investigation. The two figures concern distinct time periods and should not be read as one combined finding.
Curaçao Prepares Its Own Move, Watching What Happened in Berlin
The timing creates an uncomfortable situation for a second regulator. On 28 September, the Curaçao Gaming Authority confirmed it is considering legal proceedings against Wittmann over the separate Casino Secrets breach, in which she accessed its licensing portal from December 2025 to September 2026 using a fictitious company identity and extracted more than 40,000 documents identifying ownership structures behind hundreds of licensed gambling firms.
The CGA has filed reports with authorities in Curaçao and abroad and is monitoring where the leaked documents are being published online. It has not yet filed a formal lawsuit and says it will provide further information as its forensic investigation progresses.
Any proceedings the CGA pursues would be assessed entirely on their own legal grounds, separate from the MGA case. The German ruling carries no direct legal effect on a Curaçao matter. Still, the most recent comparable attempt by a gambling regulator to obtain a preliminary prohibition against Wittmann in Germany did not produce the outcome the MGA sought, at least according to her account of events that the MGA has neither confirmed nor denied.
Expert Analysis: What the SLAPP Strategy Gets Wrong About This Particular Hacker?
We think the MGA’s approach to this dispute raises a question regulators rarely ask before filing: what does a 1,300-page injunction do to the story you are trying to contain? In this case, the proceedings generated months of coverage, gave Wittmann a narrative of institutional pressure against public interest journalism, and ended, according to her account, with a court declining to give the regulator the prohibition it sought.
The critical distinction is not between hackers and journalists. It is between a researcher operating alone and one embedded in a coordinated international investigation alongside NDR, NRK, SVT, and Follow the Money, outlets with legal teams, editorial standards processes, and established public interest arguments. That coordination changed the nature of the public interest claim in front of the court, even if the underlying access method remained the same.
We are not suggesting the documents prove what Wittmann claims. The organised crime allegation is hers, not a court finding. What the reported interim ruling does suggest is that courts may be willing to allow documents obtained through unauthorised access to remain in use for reporting purposes when a credible public interest argument exists, even before the legality of the access has been definitively determined. That is a narrower and more cautious reading than a general precedent, and it is the only reading the available evidence supports.
For the CGA, studying the Berlin case file carefully before deciding whether to file may be worth more than filing first.
Share
3 views
