German law for malicious computer use is fairly loosely defined, and massively favours the harmed party over the one causing harm.

I don’t think it’d be a slam-dunk by any means, but a reasonably competent legal team should be able to establish a case around malicious data interference at the least. There’s certainly enough merit to the idea that OpenAI would be better off settling it as a civil matter early.