Berlin Court Lets Wittmann Keep Her Words but Not Her Access to the MGA

The Regional Court of Berlin II (Landgericht Berlin II) has issued an interim order in summary proceedings (einstweilige Verfügung) brought by the Malta Gaming Authority (MGA) and its Chief Executive Officer, Charles Mizzi, against German cybersecurity researcher Lilith Wittmann. Under case reference 7 O 254/26 eV, the court partially modified a prior injunction issued in July, establishing a distinct boundary between freedom of expression under German press law and unauthorized access to protected information systems.

The judicial decision permits Wittmann to maintain public characterizations describing the Maltese regulatory body as an “organized crime enablement scheme” and allows the continued journalistic deployment of documents previously obtained from the authority’s IT infrastructure. However, the order strictly prohibits any further access, automated scraping, or intrusion into the MGA’s digital networks.

Wittman is also the hacker behind the Casino Secrets leak, which came out of the Curaçao Gaming Authority portal breach the regulator confirmed on September 17. Her own summary of the Malta ruling on X was blunt. The good news, she wrote, was that she can call the MGA “an organized crime enablement scheme” and “use the documents I obtained.” The bad news: “I’m not allowed to hack them again.”

A Split Decision in Berlin

A screenshot of the judgment’s first page that Wittmann posted lists the MGA, represented by its chief executive Charles Mizzi, as the first applicant and Mizzi himself as the second, with the law firm Bird & Bird acting for both. The full judgment hasn’t been published, so the outcome rests on her account and the page she shared.

The speech point turned on how the court read her words. Reporting on the proceedings indicates the “organized crime” description was treated as a permissible expression of opinion rather than a factual allegation. That’s a point about German press law. It isn’t a court finding that the MGA helps organized crime.

The Hacking Question Went Unanswered

The access ban is the part the MGA won. Wittmann says the court declined to decide at this stage whether her access to the MGA’s systems legally counted as hacking, treating it as credible enough for the proceedings that it may have. So the order not to go back in stands, even without a full answer on the underlying question.

Why the Stakes Were So High

The MGA had already won a preliminary injunction against her in July, covering statements linking it to organized crime and any further access to its IT systems. Wittmann called that a SLAPP, a strategic lawsuit against public participation, and challenged it. The court heard her objection on September 10.

Had she lost, she could have faced a fine of up to €250,000 per violation, or detention of up to six months under Section 890 of the German Code of Civil Procedure (Zivilprozessordnung – ZPO).

Costs and Paperwork

She puts her lawyers’ and court fees at €15,000-€20,000 so far. “After six months, this leaves us with around 2,000 pages of court files,” she wrote, calling it “a pretty SLAPP to hang on the wall.”

The MGA has rejected that label. It has said its measures were “protective, not punitive,” aimed at stopping further unauthorized access and protecting confidential information, and that it hadn’t sought damages or any other money from her. Back in March, the regulator called the allegations made around the breach “unsubstantiated.”

The Curaçao Files Keep Coming

The ruling landed in the middle of a much bigger story. Casino Secrets, the site Wittmann built with Follow the Money, NDR, NRK and SVT, invites readers to explore over 40,000 documents about casinos licensed in Curaçao. Hours after the verdict, its original casinosecrets.lol address was put on server hold, and the archive moved to a new domain, curacaofiles.com.

The Guardian reported that the leak covers some of the biggest offshore brands. Stake’s Curaçao company, Medium Rare NV, named a Serbian national as its owner, and regulators questioned whether he really owned it. BC.Game also appears in the files. For anyone who plays at Stake or another crypto casino licensed on the island, some of the paperwork behind those licenses is now out in the open.

What the CGA Now Admits

The Curaçao regulator has confirmed most of Wittmann’s story. In a September 22 statement, the CGA said the access came through the customer-facing side of its licensing portal, using an account registered in December 2025 under a false identity, and lasted until September 2026. It called the incident “a serious breach under Curacao law” and said it would report it to the relevant authorities.

It also pushed back on the reporting. The CGA said it doesn’t find it prudent to judge its licensing process “by looking at separate documents.” It still hasn’t said how much was taken, only that it “will not repeat figures it cannot verify.”

In Berlin, the MGA got the one thing it could stop, which was Wittmann getting back into its systems. The documents she already took are still hers to use.