When 800,000 player records are exposed, what does reliability mean in Germany’s gambling market?

Germany’s regulator has spent years treating player protection as the centre of its online gambling model. The Merkur and The Mill Adventure incident puts that promise under strain, because in regulated gambling the question is not just whether a vulnerability was patched, but whether the operator, its suppliers and the oversight framework still meet the reliability standard.

1. Public reporting said the incident may have exposed data linked to more than 800,000 people across Merkur-linked German gambling sites. iGaming Business reported that cybersecurity researcher Lilith Wittmann said she accessed highly sensitive player data through a GraphQL query, including banking details and sign-up information, with the data tied to accounts on Slotmagie, Crazybuzzer and Merkurbets.
2. The same report said Wittmann submitted a report to the GGL. According to iGaming Business, the GGL warning stated that the suppliers had failed to meet their obligation to carry out an annual penetration test, which led to a lack of security for player data on the Slotmagie domain.
3. The reason this matters for PSPs and acquiring partners is simple: online gambling regulation depends on trust in identity checks, payment flows, platform security, monitoring systems and the protection of sensitive player information. If those pieces fail at scale, the issue is no longer only IT remediation; it becomes a licensing and supervision problem.
4. Germany’s framework makes that link explicit. §4a GlüStV requires extended reliability, disclosure of ownership and participation structures, lawful origin of funds, sufficient financial capability, transparency of operation, monitorability of the distribution network and real-time interfaces for checking gambling activity.

For high-risk payment providers, the practical takeaway is that a serious data-security incident in a licensed gambling environment is not just a vendor issue. In Germany, it can become evidence in a reliability review, and reliability is the thing on which access to the market turns.