Unauthorised digital access overnight into 2026-07-30 to Liechtenstein's Verzeichnis wirtschaftlich berechtigter Personen (VwbP), the national beneficial-ownership register operated by the Amt fuer Justiz under the VwbPG implementing the EU 5th Anti-Money-Laundering Directive; copies of records for roughly 31,000 legal entities were taken. The government declared it a personal-data breach under GDPR Article 33, convened a crisis unit under Head of Government Brigitte Haas and Justice Minister Emanuel Schaedler, and progressively took the eMWST VAT portal, the Lides reporting platform, the central account register and the Intax tax system offline as precautions. First forensic findings describe a targeted attack on the register with no attacks detected on other systems; no initial-access vector, actor or ransom demand had been disclosed (Regierung des Fuerstentums Liechtenstein, 2026-08-02 / 2026-08-03).
Aliases: Cyberangriff auf das Verzeichnis wirtschaftlich berechtigter Personen, Liechtenstein beneficial ownership register hack
Coverage
1
first 2026-08-04 → last 2026-10-21
Latest activity
2026-09-02
A targeted attack on Liechtenstein's beneficial-ownership register yielded a targeting dataset on the owners…
active-threatsA targeted attack on Liechtenstein's beneficial-ownership register yielded a targeting dataset on the owners behind some 31,000 Liechtenstein legal entities
2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
Initial AccessExploit Public-Facing Application
CollectionData from Information Repositories
Initial Access TA0001
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
The Verzeichnis wirtschaftlich berechtigter Personen (VwbP, "register of beneficial owners") exists because Liechtenstein implemented the EU's 5th Anti-Money-Laundering Directive: the VwbPG has been in force since 2021, and the register records the natural persons behind Rechtsträger: companies, foundations and trust arrangements. On 2026-08-02 the government disclosed that the register had been attacked and that "copies of data on around 31,000 legal entities" (translated from German) were unlawfully taken (Regierung des Fürstentums Liechtenstein, 2026-08-02), and it classifies the attack as "a personal data breach under Art. 33 of the General Data Protection Regulation (GDPR)" (translated from German) (Regierung des Fürstentums Liechtenstein, 2026-08-02). The Record and SRF both carry the same figure (The Record, 2026-08-03; SRF, 2026-08-03).
The government's own timeline is worth reading as a benchmark. Unauthorised digital access occurred overnight into 2026-07-30 (The Record gives two days of access beginning on 29 July (The Record, 2026-08-03)); irregularities were noticed at the Amt für Justiz during that day; the Amt für Informatik was brought in, secured the data and took the affected system off the network without delay; the government was informed on 31 July that the attack had potentially succeeded, and the first confirmed preliminary findings arrived on the afternoon of 1 August. A crisis unit convened that evening under Head of Government Brigitte Haas and Justice Minister Emanuel Schädler, was formally confirmed on 2 August, and a media conference was announced for 2026-08-04 (Regierung des Fürstentums Liechtenstein, 2026-08-02; Regierung des Fürstentums Liechtenstein, 2026-08-03). The government states there is no indication that data in the system was altered or deleted, and, as of 2026-08-02, the register is unavailable to external users through the LLV.li portal; it resumed in restricted form on 2026-10-05 (see the Improvement of 2026-10-07).
The forensic update on 2026-08-03 is where the operationally interesting tension sits. First findings characterise the event as a targeted attack on the VwbP at the Amt für Justiz, and "no further attacks on other systems could be established" (translated from German), yet the government kept widening the shutdown: the eMWST VAT portal and the Lides electronic reporting and data-exchange platform came off the network on 31 July, and on 3 August the central account register and the central tax system Intax followed, explicitly as precautionary measures with no indication of unlawful access (Regierung des Fürstentums Liechtenstein, 2026-08-03). Law-enforcement authorities are now engaged alongside the Amt für Informatik and external partners. No actor has been named and no ransom demand or criminal-market offering reported; the access vector is covered in the update below.
Triage: bulk read-out of a register by an external identity is a volumetric anomaly against a stable baseline, not an indicator match: a single external session enumerating tens of thousands of entities looks nothing like the handful of lookups a legitimate professional user performs, and it is detectable with no knowledge of the attacker's tooling. The benign lookalike is a sanctioned bulk export or an integrated partner system doing a scheduled sync; those are attributable to a known principal, run on a known schedule, and appear in change records, whereas this pattern is a single principal exceeding its own historical retrieval volume by orders of magnitude within one session.
In the process, copies of data on around 31,000 legal entities were unlawfully taken. (translated from German)
The attack on the VwbP is a personal data breach under Art. 33 of the General Data Protection Regulation (GDPR). (translated from German)
No further attacks on other systems could be established. (translated from German)
On Monday, 3 August 2026, the central account register and the central tax system Intax followed as well. These are purely precautionary measures. (translated from German)
A first indication of a possible entry point for the attack has been identified. (translated from German)
According to current knowledge, no unlawful access attempts were registered against either the servers of the national administration or other systems of the national administration. (translated from German)
The register lists the name of the legal entity and the surname, first name, date of birth, nationality and country of residence of the beneficial owners. (translated from German)
No address or telephone number is recorded. Likewise, no financial data of the legal entities, such as turnover, assets or dividends, is recorded. (translated from German)
The attackers exploited a vulnerability in this portal, or in the interface to the actual database, to scrape the complete register. To do so, they set up a new user account and then queried every single record in the register one after another. (translated from German)
The interface does not allow mass queries. That is why it took several hours for the attackers to download all 31,000 records, as the head of Liechtenstein's Office for IT, Fabian Schmid, told the media. (translated from German)
The government will bring the register into operation as planned on 1 October, it declared on Monday. Various measures are planned to guarantee the 'highest possible level of protection.' (translated from German)
Exxpress (Reuters wire), on the Swiss Federal Council's 2026-08-31 statement
The security analysis has shown that unauthorised access to the data was possible due to faulty authorisation-checking logic.
The Government of Liechtenstein held a media conference on 2026-08-04 and closed the largest gap in its earlier disclosure. The original coverage recorded that no initial-access vector had been disclosed; the government now states that a first indication of a possible entry point has been identified, with detailed evaluation still running (Regierung des Fürstentums Liechtenstein, 2026-08-04). It characterises the event as a targeted attack at a high technical level against a highly complex security structure, and the isolation finding is now stated positively rather than as an absence: according to current knowledge, no unlawful access attempts were registered against the state administration's servers or its other systems (Regierung des Fürstentums Liechtenstein, 2026-08-04). Further systems holding sensitive data were nonetheless taken off the network as a precaution and put through security checks.
The second addition changes the risk model rather than merely adding detail. The government published exactly what the register holds: the name of the legal entity, plus surname, first name, date of birth, nationality and country of residence of the beneficial owners, with no address or telephone number recorded (Regierung des Fürstentums Liechtenstein, 2026-08-04). Landesspiegel adds that banking systems, client funds, assets, transaction data and bank client data are not affected (Landesspiegel, 2026-08-04). The initial disclosure already pointed to pretexted contact citing verifiable register facts; that assessment now sharpens in a specific direction. What the attacker holds is an identity-verification kit (the legal entity, the full name, the date of birth, the nationality, the country of residence) and not a way to reach anyone. That combination fits identity impersonation and account-recovery abuse aimed at the fiduciaries, trustees and banks who administer these structures considerably better than it fits mass phishing of the beneficial owners, because the attacker must source contact details elsewhere before they can use any of it.
The notification mechanics are themselves worth publishing as a defensive signal. Because the register holds no contact data, the Amt für Justiz cannot notify individuals directly: it will notify the legal entities, who will in turn notify their beneficial owners, and a public information desk opened on 2026-08-04 (Regierung des Fürstentums Liechtenstein, 2026-08-04). That two-hop chain lands in the inboxes of the affected legal entities' administrators and advisers over the coming days, and it is precisely the shape a social engineer would imitate: an unexpected message about a register breach, arriving via an intermediary rather than the authority, asking the recipient to confirm who they are. Genuine and forged notifications will be in circulation in the same window.
Triage: the discriminator for recipients is direction of information flow. A genuine notification in this chain tells the recipient what happened; it does not need them to supply identity details back, because the sender already holds the relationship. A message that opens with accurate register facts and then asks the recipient to verify identity, confirm ownership or authorise a change is inverting that flow, and the accuracy of the opening facts is exactly what the stolen dataset supplies.
The Amt für Justiz has filed a criminal complaint against persons unknown, and law-enforcement authorities are evaluating digital traces in cooperation with European authorities (Regierung des Fürstentums Liechtenstein, 2026-08-04).
The access vector, earlier reported as undisclosed, is now named. Reporting from the Neue Zürcher Zeitung states that the attackers did not reach the register's database directly: they exploited a vulnerability in the register's reporting portal, or in the interface between that portal and the database, to scrape the complete dataset (Neue Zürcher Zeitung, 2026-08-07). To do so, they registered a new user account on the portal and then queried every one of the roughly 31,000 records individually (Neue Zürcher Zeitung, 2026-08-07). The interface has no bulk-query function, which is why the download took several hours, as the head of Liechtenstein's Office for IT, Fabian Schmid, told the media (Neue Zürcher Zeitung, 2026-08-07).
This breach has become the argument in a live Swiss policy fight over a comparable register. The Verband Schweizerischer Vermögensverwalter (VSV) wrote to Justice Minister Beat Jans warning that Switzerland's own Transparency Register, then due to go live on 1 October 2026, would be an "extremely attractive target for cyber criminals" (Inside Paradeplatz, 2026-08-31, citing the Financial Times' quotation of the letter), and asked for a delay or stricter access controls; the letter is dated 24 August 2026 and was seen by Reuters (Exxpress, citing Reuters wire, 2026-08-31). The Swiss Bankers Association (SBVg) separately raised the same concern. The Swiss Federal Council confirmed on 31 August 2026 that it will proceed with the 1 October launch unchanged, stating that various measures are planned to guarantee the "highest possible level of protection" (translated from German) (Exxpress, citing Reuters wire, 2026-08-31).
Unlike Liechtenstein's compromised portal, the Swiss register is designed to run inside a dedicated secured network of the Federal Department of Justice and Police, is an in-house Confederation build rather than an external vendor's system, and restricts direct database access to the operating office and a Federal Department of Finance control unit; external reporting parties reach it only through the EasyGov portal or a dedicated interface, the same portal-mediated access pattern that let the Liechtenstein attacker enumerate all 31,000 records one by one through a vulnerable reporting interface (Neue Zürcher Zeitung, 2026-08-07).
Defender takeaway (updated): for Swiss fiduciaries, trustees and banks, in analyst judgement the client populations of the two registers overlap, so the Swiss register, which went live on 1 October 2026 (Federal Office of Justice, 2026-10-01) and covers companies and other legal entities, an estimated 500,000 under the Federal Council's proposal, as NZZ reported in June 2025, before both chambers of Parliament removed foundations and associations from its scope (Neue Zürcher Zeitung, 2025-06-13), adds a second authoritative identity-verification dataset attackers can draw on for the pretexting risk described above. The detection lesson carries over directly: a single reporting account exceeding its own historical query volume by orders of magnitude in one session is the signal to watch for on the Swiss register's EasyGov-mediated access path, portal-side rate limiting or not.
The government's release of 2026-08-19 gives its own account of the cause: Fabian Schmid, head of the Office of Information Technology, said the security analysis showed the unauthorised access was possible "due to faulty authorisation-checking logic", which allowed the application programming interface to be exploited "through repeated individual requests in a manner that was not intended", and that it was "not a classic software vulnerability" (Liechtenstein Government, 2026-08-19). The fixes it announced are an upstream eID step in the requirements for verifying user accounts and checking identity, and wider monitoring and detection so that unauthorised access is noticed earlier (Liechtenstein Government, 2026-08-19).
On 2026-10-06 Inside IT reported the Head of Government's answer to a Landtag question: the identified weaknesses have been fixed, a check of data integrity found no sign that register data was altered, the register resumed operation in restricted form on 5 October, there is still no indication of concrete misuse of the copied data, and an external IT review is expected to report in the first half of 2027 (translated from German) (Inside IT, 2026-10-06). The perpetrators remain unknown (Inside IT, 2026-10-06).
Switzerland's Transparency Register went live on 1 October 2026 (Federal Office of Justice, 2026-10-01). The roughly 500,000 figure is the Federal Council's estimate of the companies and other legal entities its proposal would cover, as NZZ reported in June 2025, before both chambers of Parliament removed foundations and associations from its scope (Neue Zürcher Zeitung, 2025-06-13); it does not count beneficial owners, as the 2026-09-02 note had it.
NZZ attributes to Fabian Schmid, head of Liechtenstein's Office for IT, only the statement that the interface allows no bulk query, so the download of all 31,000 records took several hours. The access mechanism, a vulnerability in the reporting portal or in its interface to the database, used through a newly registered account that queried each record in turn, is NZZ's own reporting, which it does not attribute to Schmid or to the government's 2026-08-04 media conference (Neue Zürcher Zeitung, 2026-08-07).
The government classifies the attack on the VwbP as "a personal data breach under Art. 33 of the General Data Protection Regulation (GDPR)" (translated from German) (Regierung des Fürstentums Liechtenstein, 2026-08-02).