German Hacker Claims MGA Breach, Threatens iGaming Exposé

German security researcher Lilith Wittmann has claimed responsibility for hacking the Malta Gaming Authority. This escalated into a cyber incident that the regulator first disclosed on 17 March 2026.

The MGA said it identified a breach in one of its systems. Containment and investigation measures were put in place. Days later, Wittmann publicly said she was behind the intrusion. She alleged the data would expose deeper failings at the regulator. The MGA has rejected those wider claims as unsubstantiated.

MGA breach claim turns public

The dispute intensified after Wittmann posted on social media that she had  hacked the  MGA and shared the data with media partners and authorities. She also warned against any attempt to extradite her. She said further action could trigger a wider release of archived iGaming-related material. Those remarks came after the MGA confirmed it was investigating what it described as unauthorised access by someone posing as a security researcher.

In its follow-up statement, the MGA condemned any unauthorised access to its systems and the extraction or dissemination of data obtained that way. The regulator said such conduct was incompatible with lawful engagement with public institutions. It insisted its statutory role continues to rest on integrity, independence and accountability. It also said allegations made in the context of the breach do not undermine its role as a regulator committed to transparency, due process and the rule of law.

Who is Lilith Wittmann?

Wittmann is a Berlin-based security researcher and activist. She is linked to the Chaos Computer Club, which describes itself as Europe’s largest association of hackers. The group focuses on surveillance, privacy, freedom of information and data security.

Wittmann herself has built a public profile. This is through security disclosures that have triggered legal and political fallout in Germany.

She became widely known in 2021 after exposing vulnerabilities in the CDU’s campaign app. This was an incident that reportedly gave access to personal data linked to more than 20,000 party members. The case drew attention because of the scale of the exposure, but also because of the fallout over how authorities and political actors responded to her findings.

Gambling industry link adds another layer

This is not Wittmann’s first clash with the gambling sector. In March 2025, reports said she revealed a major data exposure tied to Merkur Group gambling platforms. These included merkurbets.de, crazybuzzer.de and slotmagie.de.

Coverage at the time said the issue involved player data and KYC material, while Malta-linked supplier The Mill Adventures was named in reporting around the software stack behind the affected sites. Merkur reportedly moved the same day to close the vulnerability and introduce further audits and safeguards.

That history gives the latest MGA row extra weight. Malta is one of the most important gambling licensing regulators in Europe. This means that any confirmed breach at the regulator itself would raise questions about cyber resilience, regulatory credibility and the handling of sensitive industry data. At this stage, though, there is still no public confirmation of what information was accessed. Nor can Wittmann’s claims be fully verified.