NewsCompaniesFlawsGuides
Get the app
HighClosedUpdated

Liechtenstein beneficial ownership register breached; data on about 31,000 entities copied

Liechtenstein's beneficial owner register was hacked on 30 July 2026 and data on about 31,000 companies, foundations and trusts was copied. It holds owners' names, birth dates, nationalities and residence. Register reopened in limited form 5 Oct; no sign of publication.

What to do

If you are listed as an owner of a Liechtenstein company, foundation or trust, expect a notice from the entity and treat unexpected emails, calls or messages that quote your name, birth date or ownership with suspicion. Confirm any request through a contact you already know before acting. Ask your trustee or adviser if unsure.

What’s happening

An unknown attacker broke into Liechtenstein's Register of Beneficial Owners of Legal Entities (VwbP) in the night of 30 July 2026 and copied data on about 31,000 companies, foundations and trusts. The government says the register holds each entity's name and its beneficial owners' surname, first name, date of birth, nationality and country of residence. It holds no addresses, phone numbers or financial details such as assets. The government described a targeted, technically sophisticated attack that hit the register only, and says no other state servers showed unlawful access. It filed a criminal complaint against persons unknown, and prosecutors are working with European authorities. Because the register has no contact details, the government notified the legal entities and asked them to tell the people involved. The register reopened in a limited form on 5 October, with in-person identification in Vaduz, after the vulnerabilities found were fixed. Backups show the data was not altered. As of 2 October there were no signs the stolen data had been published, no perpetrator had been named, and the investigation and an independent external review were still under way.

What
Breach
Affects
Liechtenstein Register of Beneficial Owners (VwbP)
Fixed in
Nothing to patch
Since
2 Aug 2026
Closed
2 Oct 2026

Timeline

  1. All clearNothing to patch

    The government said the register would reopen in limited form on 5 October, with in-person identification in Vaduz, after the vulnerabilities found were fixed. Backups showed the data was not altered. Investigations continue, there are no signs the stolen data has been published, and an independent external review is still being procured.

  2. Update

    The government said it would bring in an international firm for an additional review of the incident and a wider audit of systems holding sensitive data. It said there were still no indications the data had been misused, and that systems taken offline were being restored after checks.

  3. Update

    The government said forensic work had found a possible entry point and described a targeted, technically sophisticated attack on the register alone. It listed the data held (names, dates of birth, nationalities, countries of residence), said a criminal complaint against persons unknown had been filed, and began notifying the legal entities so they could inform the people involved. Other systems holding sensitive data were taken offline for checks.

  4. Update

    Prime Minister Brigitte Haas told Swiss broadcaster SRF that no ransom demand had been received and the data had not appeared on the dark web, according to Swissinfo.

  5. Made publicNothing to patch

    The government announced that an unknown party had gained unauthorised access and copied data on about 31,000 legal entities. The system was taken offline, a crisis unit was set up and the incident was treated as a personal data breach under GDPR. There was no evidence data was altered or deleted.

  6. Update

    Liechtenstein's Office of Justice noticed irregularities in the Register of Beneficial Owners (VwbP) and called in the Office of Informatics. The government places the attack in the night of 30 July.

Sources

  1. Cyberattack on the Register of Beneficial Owners (VwbP): initial statementGovernment of Liechtenstein · 2 Aug 2026
  2. Cyberattack on the VwbP: update of 4 AugustGovernment of Liechtenstein · 4 Aug 2026
  3. Following the cyberattack: additional external IT reviewGovernment of Liechtenstein · 31 Aug 2026
  4. Following the cyberattack: limited resumption of VwbPGovernment of Liechtenstein · 2 Oct 2026
  5. 31,000 copies of data belonging to legal entities stolen in LiechtensteinSwissinfo · 3 Aug 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS