A Berlin-based security researcher has now hacked, by her own account, two of the most important gambling regulators in the world, and the poker industry is watching nervously. Lilith Wittmann said in March 2026 that she had accessed the web portal of the Malta Gaming Authority (MGA), and in September she announced a second hack targeting the Curaçao Gaming Authority (CGA). The data she extracted has since been compiled into a searchable website, and the legal fallout is still unfolding.
This is a complicated story, and it is easy to get it wrong. The facts reported so far do not show wrongdoing by poker operators, and the licences in question remain valid. But the episode raises real questions about how licensing works in online gambling, what regulators know about the businesses they supervise, and how players should think about the sites where they deposit money. This article explains what has been reported by PokerListings, what it means for poker, and what steps players can take to protect themselves.
What happened
According to PokerListings, Wittmann describes her work as exposing criminal schemes in online gambling. In March 2026 she publicly claimed she had hacked the MGA web portal and said she had provided the extracted data to the media and to authorities. She accused the MGA of "organized crime enablement schemes." The MGA denied the allegation and took legal action against her, alleging that she hacked the database and leaked sensitive information.
In September 2026 she announced a second hack, this time targeting the CGA. On September 23, she launched a public website, casinosecrets.lol, that allowed users to search by brand name or domain. The site combined the MGA data with public registers from Malta, Cyprus, Gibraltar, and Curaçao. It was shut down quickly and then restarted. A duplicate database was posted elsewhere and remains publicly accessible.
PokerListings reports that the database draws on more than 84,000 documents. These include information about business owners, documents submitted by operators for licensing, lists of domains tied to entities, and other details. The article notes that the data appears exactly as it did in the original sources, which means it may be outdated, incomplete, or contain errors.
The legal picture
The legal status differs between the two cases. In Malta, Wittmann recently won a partial victory. She is allowed to share the documents with journalists and investigative bodies and to speak publicly about the MGA, but she is barred from hacking the MGA portal again. In Curaçao, the situation is unresolved, and PokerListings suggests the CGA may also take legal action. German authorities reportedly examined the documents for evidence of facilitation of illegal gambling.
It is worth emphasising what this does and does not mean. The fact that documents have been published does not prove that any operator committed a crime. The licences remain valid and active. PokerListings stresses that holding a licence from either regulator is not in itself a crime, and the data may contain errors. Players should be cautious about reading too much into a database of raw documents.
Why poker players should care
Many online poker rooms operate under licences from Malta, Curaçao, or similar jurisdictions. Our poker networks page explains how the major networks are structured and which regulators oversee them. Because licensing is the core of consumer protection for online gambling, any story that questions how a regulator works is relevant to players.
So far, the effect on poker has been minimal. PokerListings reports that no major poker operator has publicly commented on the hacks or acknowledged them on social media. Promotions, major tournament series, and bonuses have continued, and there is no visible financial impact. The article offers two possible reasons. First, Wittmann's focus is on casinos and gambling operators harming German citizens, and Germany's strict rules may mean the leaked data contains nothing incriminating about poker rooms. Second, no concrete evidence of criminal schemes from these documents has been published yet.
That said, the stories are a reminder of three truths about online poker.
A licence is a minimum standard, not a guarantee
A licence tells you that an operator has met the basic requirements of a regulator. It does not tell you how strong the regulator's oversight is, how fast the operator pays withdrawals, or how seriously the operator treats player disputes. A site with a licence from a strict jurisdiction offers different protections than a site with a licence from a lighter-touch regulator. Always check where a licence is issued, and read the terms about dispute resolution.
Data security matters at every level
The hacks show that even regulators can be vulnerable. Operators hold sensitive information about their players: identity documents, payment details, and play histories. If a regulator's portal can be breached, a poker site's systems can also be a target. Choose operators with a strong security record and clear privacy policies. Our safe poker sites guide explains the factors we weigh when we rate security, such as encryption, withdrawal history, and independent audits.
Transparency is increasingly expected
One reason the story has gained traction is that the public cannot easily see who owns the companies behind many gambling brands. A searchable database of ownership information, whatever its accuracy, shows how strong the appetite is for transparency. Players are more likely to trust sites that publish clear information about their ownership, licensing, and complaint procedures.
How to protect yourself as a player
The risk to an individual player from this news is low, but good habits are always worth practising.
- Check the licence details. Find the licence number and the regulator on the site's footer. Confirm it with the regulator's public register where possible. Remember that the PokerListings report advises players to check which jurisdictions each licence covers before playing.
- Keep your balance modest. Do not leave more money on a site than you need for your next sessions. Withdraw winnings regularly. Our payments page covers common deposit and withdrawal options and their speed.
- Use strong account security. Enable two-factor authentication wherever it is offered, use a unique password, and avoid logging in on public Wi-Fi.
- Read recent reviews. Look at current player experiences with withdrawals and support. Our real money poker guide explains what to check.
- Understand your local law. In some countries, offshore licences are not recognised, and players may have limited recourse. Check the rules in your area, and see our US, Canada, and UK guides for regional information.
What the industry should do
Whether or not any operator has done wrong, the incident highlights several issues for the industry.
- Regulators need robust cyber security. If a regulator holds sensitive documents about licensees, it must protect them. A breach can expose business owners and commercial information, and it undermines trust in the system.
- Operators should be ready to answer questions. Silence is understandable while legal matters are ongoing, but players expect operators to explain their licensing and ownership structures when asked.
- Cross-border cooperation matters. The data combines registers from Malta, Cyprus, Gibraltar, and Curaçao, and German authorities are reported to have looked at it. Gambling regulation is fragmented, and enforcement often depends on cooperation between countries.
A balanced view
It is tempting to treat this story as a scandal, but the facts do not support that conclusion for poker. The poker networks and skins licensed by the MGA or the CGA are legally authorized to operate. The data is raw and may contain mistakes. And as of now, no poker-specific wrongdoing has been identified in the public record.
At the same time, it would be a mistake to dismiss the news. The disputes over the hacks, the quick takedown and reappearance of the website, and the legal battles in Malta and Curaçao show that the debate over online gambling regulation is intensifying. For players, that means the landscape could change. Regulators may tighten their rules, banks may become more cautious about gambling payments, and operators may need to provide more information to retain their licences.
Final thoughts
For now, the practical advice is simple: keep playing at reputable sites, stay informed, and don't overreact. Our safe poker sites and real money poker pages are updated regularly, and we will report on any official findings or regulatory changes that affect the sites we review.
The story is also a reminder that online poker sits inside a larger gambling industry. Decisions made in Valletta, Willemstad, or Berlin can affect the rooms where you play. As a player, the best defence is knowledge: know who licenses your site, know where your money is held, and know what to do if something goes wrong.