A vulnerability exposes the MGA
•
24 Mar 2026 •
Reading time: 3 minutes
The Malta Gaming Authority (MGA) recently detected an intrusion into its IT systems. A few days later, a German female hacker claimed responsibility for the breach.
Intrusion detected internally
On 19 March, the Malta Gaming Authority announced that it had identified unauthorised access to some of its systems. In an official statement, the regulator explained that it had swiftly taken measures to contain the incident. The intrusion was contained and the affected systems were secured. It emphasised that its technical teams had acted immediately to limit the risks.
Shortly after the MGA’s announcement, an unexpected response emerged. Lilith Wittmann, known for her revelations about security breaches, claimed to be behind the intrusion. In her statements, she explained that she had discovered significant vulnerabilities in the Maltese regulator’s systems. These included systems accessible without robust authentication and potentially exposed internal data.
The Malta Gaming Authority is one of the cornerstones of the global online gambling industry. Hundreds of operators use its licences to operate internationally. A breach in its systems therefore affects not only the authority itself, but potentially an entire ecosystem.
Controversial allegations
In her message, Lilith Wittmann explains that she passed on the data she obtained to journalists and the relevant authorities, framing her actions as a disclosure she believes to be in the public interest. She accuses the MGA of facilitating activities linked to organised crime.
“For the time being, I have nothing to say regarding forthcoming publications on organised crime networks supported by countries such as Malta. I would therefore ask you not to ask any questions on this subject until further notice.”
In her post, she also warns against any attempt to extradite her to Malta. According to her, such a procedure could lead to the wider dissemination of the data in her possession. She also mentions the risk of a sentence of up to ten years in prison in Germany if prosecuted for hacking a public service.
In response to these statements, the Maltese regulator was quick to react. The Malta Gaming Authority firmly rejected these allegations, describing them as unfounded and unsubstantiated.
“The Malta Gaming Authority (MGA) has taken note of the public statements made by an individual claiming responsibility for unauthorised access to one of its systems and, in this context, making a series of allegations and threats.
“The MGA condemns any unauthorised access to its systems, as well as any extraction, manipulation or dissemination of data obtained through such activities. Such behaviour is unacceptable and incompatible with a legitimate relationship with public institutions and established governance frameworks.
“The Authority operates within a robust legal and regulatory framework and carries out its statutory functions with integrity, independence and accountability. The allegations made in the context of this unauthorised access to the system are baseless and do not call into question the MGA’s role as a regulatory authority committed to transparency, due process and the rule of law.
“For more than two decades, the MGA has operated in accordance with established legal and governance frameworks, and will continue to do so. It is paramount to ensure that the Authority’s work, as well as the sector it regulates, is conducted with integrity and accountability.”
Lilith Wittmann
A well-known figure in Germany’s hacking community, this is reportedly not Wittmann’s first high-profile stunt. She is notably linked to a previous breach targeting the systems of the operator Merkur, a case that contributed to the closure of several offshore sites the previous year.