Hackers copy ownership records for 31,000 Liechtenstein entities

Why it matters

Beneficial ownership registers give authorities a direct view through companies, trusts and foundations. The same concentration makes a single breach valuable to criminals and intelligence operators.

Hackers copied data associated with roughly 31,000 legal entities from Liechtenstein's beneficial ownership register, forcing the government to take the system offline and begin notifying affected people and organizations.

The attack occurred during the night of July 30th, according to the Liechtenstein government account reported by Reuters. Officials said irregular activity was detected later that day by the Office of Justice, which brought in the Office of Information Technology to investigate.

Authorities disconnected the affected system from the network, secured the remaining data and opened an investigation. The government was informed of a potentially successful breach on July 31st. Investigators confirmed on August 1st that an unidentified attacker had accessed the register and extracted copies of records covering about 31,000 entities.

Liechtenstein Prime Minister Brigitte Haas and Justice Minister Emanuel Schaedler are leading a government crisis team established on the evening of August 1st and formally confirmed the following day. The team is handling the investigation, countermeasures and notifications to affected parties.

Officials said they had found no evidence that information inside the system was changed or deleted. The government has not identified the attacker or described the method used to enter the register.

A concentrated store of ownership data

The compromised database is more sensitive than a conventional company directory. Liechtenstein's Register of Beneficial Owners records the people who ultimately own or control legal entities, including companies, foundations and trusts.

Liechtenstein created the electronic register to support investigations and compliance work involving money laundering, related offenses and terrorist financing. The law establishing it took effect on April 1st, 2021, implementing requirements from the European Union's fifth anti-money laundering directive.

Legal entities submit their ownership information through a government portal administered by the Office of Justice. Banks, financial institutions and other authorized parties can request disclosures from the register when carrying out anti-money laundering checks.

That concentration makes the database useful to regulators and an unusually valuable target. A successful intrusion can connect named people to corporate and fiduciary structures that may span several jurisdictions. The risk extends beyond Liechtenstein because entities registered in the principality can have owners, controllers and commercial relationships abroad.

The government classified the incident as a personal data breach under Article 33 of the European Union's General Data Protection Regulation. It is preparing direct notifications under Article 34, which covers breaches likely to create a high risk to individuals' rights and freedoms. Authorities also established a central contact point for questions from affected parties.

External access to the register through the Liechtenstein government website remains suspended while officials investigate. The administration's response preserves the underlying database, according to the government's preliminary findings, while cutting off the service used to retrieve its information.

Transparency creates a security burden

Beneficial ownership registers are designed to remove the layers of legal entities that can conceal who controls an asset or business. The Liechtenstein breach shows the security burden created when governments assemble that information in one searchable system.

The records serve banks, regulators and law enforcement agencies that need to trace ownership. The same relationships can support targeted phishing, fraud, surveillance or coercion if obtained by an attacker. The risk depends on the specific fields copied and the people connected to the affected entities.

Liechtenstein's immediate task is determining how access was obtained and which records were copied. Its longer-term problem is restoring a register that remains central to the principality's anti-money laundering controls without recreating the same point of exposure.

The incident was first disclosed publicly on August 2nd, when the government called a short-notice media briefing. Local newspaper Liechtensteiner Vaterland reported that Haas, Schaedler, Office of Information Technology head Fabian Schmid and Office of Justice head Martin Alge presented the initial findings.