Liechtenstein’s government has confirmed a major cyberattack on its Register of Beneficial Owners (VwbP), with hackers unlawfully accessing and copying data belonging to approximately 31,000 legal entities, including companies, foundations, and trusts. The breach, detected in late July 2026, has prompted a high-level crisis response and raised concerns about the security of one of the world’s most secretive financial jurisdictions.
Timeline and Discovery of the Breach
The intrusion occurred during the night of July 29 to July 30, 2026, when unknown perpetrators gained digital access to the VwbP system. Authorities detected the breach on July 31 and secured the data, taking the register offline for external users. Preliminary investigation results were delivered to the government on August 1, confirming that copies of data from around 31,000 legal entities had been exfiltrated.
The government stated that the attackers spent “several hours” inside the system, accessing data individually rather than in a single bulk download, before the breach was detected and the system shut down. The register, established under a 2021 act as part of anti-money laundering (AML) measures, remains unavailable via the llv.li website pending further security reviews.
Scope and Nature of Compromised Data
According to official statements, the stolen data includes the names, nationalities, dates of birth, and countries of residence of the beneficial owners behind the affected legal entities. However, the register did not contain financial information such as asset values, revenue, or dividend records. Prime Minister Brigitte Haas emphasized at a press conference that there is no evidence the hackers accessed bank accounts or financial data, and no indication that records were altered or deleted during the attack.
The breach affects a significant portion of Liechtenstein’s corporate and foundation landscape. With a population of just over 40,000, the principality hosts a disproportionately large number of offshore entities, making the VwbP a critical tool for global AML and counter-terrorist financing efforts.
Government Response and Crisis Management
In response to the incident, Liechtenstein established a crisis team led by Prime Minister Brigitte Haas and Justice Minister Emanuel Schadler. The team is working “around the clock” to identify the perpetrators, assess the purpose of the attack, and notify affected parties as required under the EU’s General Data Protection Regulation (GDPR).
Authorities have not publicly identified the attackers or disclosed whether the stolen information has been published or used for extortion. Fabian Schmid, head of Liechtenstein’s office on information technology, noted that the perpetrators accessed the system after creating a user account for the register, raising questions about how they bypassed authentication and remained undetected for several hours.
Implications for Financial Secrecy and AML Compliance
Liechtenstein has long been regarded as a haven for ultra-high-net-worth individuals seeking confidentiality for their wealth structures. The VwbP was introduced to increase transparency and comply with international AML standards, but the breach exposes vulnerabilities in the system’s security and raises concerns about the potential misuse of beneficial ownership data.
The incident is part of a broader global trend of cyberattacks targeting financial and regulatory databases, underscoring the risks associated with digitizing sensitive ownership information. While the Liechtenstein government has assured that no financial data was compromised, the exposure of personal details for 31,000 entities could facilitate targeted phishing, identity theft, or further investigative journalism into offshore wealth.english.
Ongoing Investigation and Next Steps
Investigators continue to analyze digital forensics to determine the origin and motive behind the attack. The government has pledged to keep the register offline until security can be assured, and to inform affected entities as soon as possible.
The breach has also prompted wider scrutiny of cybersecurity protocols for beneficial ownership registers across Europe, with calls for enhanced safeguards to prevent similar incidents in other jurisdictions.