I think that the actual bug was indeed found and proven, most likely by the company themselves or an auditor (or perhaps even from their supplier). The article

I think that the actual bug was indeed found and proven, most likely by the company themselves or an auditor (or perhaps even from their supplier). The article states that this happened 14 times over a period of 48 days so there must be some sort of record that was found. Of course, a less scrupulous casino regulated by some more ‘business friendly’ government might tell you to go pound sand and not admit anything, so actually getting anything relies mainly on the legal system.