Researcher Hacked Two Gaming Authorities in 2026: What Does It Mean For Poker?

One Year, Two Gaming Authorities: a Brief Recap

In March 2026, Lilith Wittman publicly claimed responsibility for hacking the Malta Gaming Authority (MGA) web portal, also announcing that she had handed over the extracted data to the media and authorities.

She accused the MGA of facilitating “organized crime enablement schemes,” but the licensee not only denied the allegation but also sued her for hacking the database and leaking sensitive information from it.

While the legal dispute between them dragged on and German authorities examined the documents received from Lilith for evidence of facilitating illegal gambling, the young woman did not stop working.

In September 2026, Lilith Wittmann announced a new successful hacking — but this time, she targeted Curaçao Gaming Authority (CGA).

On September 23rd, she launched the public website casinosecrets.lol, where this information — along with data from the Malta Gaming Authority and public registers from Malta, Cyprus, Gibraltar, and Curaçao — could be accessed simply by entering a brand name or domain. The site was shut down very quickly but Lilith acted almost instantly and restarted it. She also made a duplicate for the database on curacaofiles.com, keeping it publicly accessible to everyone.

What data does this database contain? From over 84,000 documents, Lilith extracted information about business owners, all documents submitted by operators to authorities for licensing purposes, a list of domains associated with the entity, and other details.

What Do Poker Operators Say?

None of the major players in the poker industry have made any public statements regarding these hacks. Moreover, they haven’t even acknowledged them on social media.

And judging by the volume of promotions, major tournament series, and bonuses that poker rooms have continued to offer players throughout the year, these data leaks have had no impact whatsoever on their financial standing.

There could be two reasons for this.

First, Lilith Wittmann’s investigation focuses on casinos and gambling operators — specifically on the harm caused to citizens of her home country, Germany, by illegal or dubious entities in the sector.

Germany is well-known among poker players for its harsh environment for regulars, strict gambling regulations, and a history of legal action penalizing poker rooms for even the slightest infractions; therefore, it is quite possible that the leaked data simply contains nothing incriminating regarding the poker rooms themselves.

Second, no concrete evidence of criminal schemes established through these documents has been published yet.

Regarding the Malta aspect, Lilith recently achieved a partial legal victory: she won the right to share the obtained documents with journalists and investigative bodies and to speak publicly about the Maltese regulator, though she remains prohibited from hacking the MGA’s web portal again. The situation regarding Curaçao remains in limbo, as not enough time has passed. It is quite likely that this regulator will also eventually take legal action against Lilith — we can only wait for the outcome.

In this situation, it is crucial to understand that holding a license from any of these regulators is neither a crime nor an illegal act.

Moreover, these licenses remain valid and active, while all information in this database is presented exactly as it appeared in the original source. This means it may be outdated, incomplete, or simply contain errors.

Poker networks and their skins licensed by the Malta and Curaçao gaming authorities are legally authorized to operate; however, as a player, you must check the jurisdictions where these licenses apply to avoid legal issues associated with accessing gambling services in territories where they cannot legally be provided under those specific licenses.