Lilith Wittmann (born 26 September 1995) is a German software developer, security researcher and activist. She is known for identifying security vulnerabilities in digital services, including the CDU connect campaign app, the ID Wallet digital identity app and online gambling platforms.
Early life and career According to Wittmann, she left school at the age of 16 and subsequently completed vocational training in application development. Alongside her employment, including work at an international management consultancy, she studied political science, sociology and public administration. She is based in Berlin.
In 2020, Wittmann participated in the Work4Germany fellowship programme at Germany's Federal Ministry of Education and Research, where she worked on projects concerning digital education and collaboration within the federal administration.
Wittmann is a member of zerforschung, a collective that investigates the security of information technology systems.
Security research
Luca and CDU connect Wittmann attracted media attention in 2021 after identifying security vulnerabilities in the Luca contact-tracing app and CDU connect, a campaign app used by the Christian Democratic Union of Germany (CDU).
In July 2021, CDU federal managing director Stefan Hennewig filed a criminal complaint naming Wittmann. Before publishing her findings, she had notified the app developer and the relevant authorities and waited until the app had been disabled, following the principles of responsible disclosure. In response to the complaint, the Chaos Computer Club announced that it would no longer report vulnerabilities in CDU systems, citing the risk of legal proceedings against security researchers.
Following public criticism, the CDU announced that it had withdrawn the complaint against Wittmann. Hennewig said that the complaint concerned the publication of personal data by third parties and public disclosures made before the CDU was notified. He acknowledged that Wittmann had been involved in neither incident and apologised for naming her.
The investigation was discontinued in August 2021. According to netzpolitik.org, the decision was based on the absence of access controls protecting the data, rather than the CDU's announced withdrawal of its complaint. The relevant provision of German criminal law concerning unauthorised access to protected data therefore did not apply.
Videoconferencing and digital identity In July 2021, Wittmann identified a vulnerability in Visavid, a videoconferencing platform used in Bavarian schools. The vulnerability allowed users to join a conference without approval, bypassing its waiting room.
In late September 2021, Wittmann and Fabian Lüpke reported vulnerabilities affecting the ID Wallet app, including the possibility of taking control of a subdomain belonging to its publisher. Wittmann warned that the vulnerabilities could enable the theft of personal data and identities. The app, which was intended to store documents including a digital version of a driving licence, was withdrawn a few days after its launch.
Credit-reporting services In July 2023, Wittmann demonstrated a vulnerability in Bonify, a credit-reporting platform owned by Schufa, by generating and publishing a purported tenant credit report in the name of CDU politician Jens Spahn. Bonify temporarily disabled the affected service following the publication.
In November 2024, she identified a similar vulnerability in the credit-reporting service "it's my data", again using Spahn's name to demonstrate the issue.
Prison systems In June 2024, Wittmann reported that some telecommunications records relating to inmates in German prisons were accessible without password protection. At the 38th Chaos Communication Congress in December 2024, she presented her broader investigation into the security of prison telecommunications systems and administrative software. She also described obtaining prison newspapers for her research and making them available through the website knastarchiv.de.
Online gambling In March 2025, Wittmann published an investigation into vulnerabilities affecting online gambling services operated by the Merkur Group. Records relating to hundreds of thousands of users, including copies of identity documents and correspondence from Germany's employment agency, were accessible through a GraphQL API. The Merkur Group subsequently suspended gambling functions on three online platforms, although the vulnerabilities had reportedly already been fixed.
Several days later, additional online casinos using the same software were taken offline. According to Heise Online, those platforms were suspected of operating illegally in Germany. Wittmann said that she intended to use the approximately 200 GB of extracted data for research into problem gambling.
In March 2026, Wittmann claimed responsibility for gaining unauthorised access to a system operated by the Malta Gaming Authority. She alleged that the material she obtained indicated links between the regulator and organised crime; according to ISA-GUIDE, she did not initially publish evidence substantiating those allegations. The authority rejected the allegations as unsubstantiated and condemned the unauthorised access and the extraction or dissemination of data obtained through it.
Activism and digital policy
Open data and government transparency In August 2021, Wittmann launched a website documenting publicly accessible application programming interfaces provided by government bodies. She described the project as a criticism of government agencies' lack of action on open data. The project also includes publicly accessible Git repositories published under the name bundesAPI.
In 2022, Wittmann highlighted privacy problems in Germany's online commercial register portal, where documents available for download included copies of identity documents and residential addresses. Access to the portal had become free of charge and no longer required registration on 1 August 2022.
Bundesservice Telekommunikation In January 2022, Wittmann published an investigation into Bundesservice Telekommunikation, an obscure entity listed in Germany's federal government directory. In a subsequent report, she described sending a parcel containing an AirTag to trace its delivery and concluded that the entity was a cover organisation for the Federal Office for the Protection of the Constitution (BfV).
Wittmann has stated that she opposes the BfV on political grounds and intends her exposure of its cover organisations to obstruct its activities. She has also stated that she is a member of the Association of Persecutees of the Nazi Regime – Federation of Antifascists (VVN-BdA) and the solidarity organisation Rote Hilfe.
Parliamentary hearing On 14 December 2022, Wittmann appeared as an expert at a public hearing of the Bundestag's Committee on Digital Affairs concerning Web 3.0 and the metaverse. She discussed privacy and security concerns associated with blockchain-based systems, including their use for digital identity documents.
References
External links
Official website Interview on digital policy and the ID Wallet controversy, with Christian Wölbert and Holger Bleich, 31 January 2022 "Knäste hacken", presentation at the 38th Chaos Communication Congress, 30 December 2024