Log in Request a demo

Significant cyber incident

Liechtenstein beneficial owner register breach

In the night before 30 July 2026, an unknown actor got into Liechtenstein's register of beneficial owners (VwbP) and copied data on about 31,000 legal entities.

In short

In the night before 30 July 2026, an unknown actor got into Liechtenstein's register of beneficial owners (VwbP) and copied data on about 31,000 legal entities. The government says faulty permission checks let the register's API be used in a way it was not meant to be. The register holds no addresses, phone numbers or financial data. It reopened in limited form on 5 October 2026.

Last updated October 2026

What happened

In the night before 30 July 2026 an unknown actor gained access to Liechtenstein’s register of beneficial owners (VwbP) and copied data on about 31,000 legal entities. The Office of Justice noticed irregularities during 30 July, and the IT office took the system offline. The government was told on 31 July and published the incident on 2 August.

The register holds the name of each legal entity and, for its beneficial owners, name, birth date, nationality and country of residence. The government says it holds no addresses, phone numbers or financial data. It also says there was no sign that data was changed or deleted.

Several other state systems were taken offline as a precaution while they were checked. The register reopened in limited form on 5 October 2026. As of 2 October, officials saw no sign that the stolen data had been published.

Timeline

  1. Night before 30 July 2026

    An unknown actor gains unlawful access to the VwbP.

  2. 30 July 2026

    The Office of Justice notices irregularities; the IT office takes the system offline.

  3. 31 July 2026

    The government is told a possibly successful attack took place; the eVAT portal and the Lides platform go offline as a precaution.

  4. 1 August 2026

    First confirmed results reach the government; a crisis team is called in the evening.

  5. 2 August 2026

    The government publishes the incident: about 31,000 legal entities affected; criminal complaint filed against unknown persons over the weekend.

  6. 3 August 2026

    The central account register and the Intax tax system are taken offline as a precaution; a focus page goes online.

  7. 4 August 2026

    Officials report a potential entry point; an information line opens; legal entities are asked to inform their beneficial owners.

  8. 5 August 2026

    The crisis team decides to check and pause more systems.

  9. 6 August 2026

    The prosecutor asks the Princely Court for preliminary inquiries against unknown persons.

  10. 10 August 2026

    The commercial register is reported offline as a precaution.

  11. 19 August 2026

    Security analysis: faulty permission checks allowed the API to be abused.

  12. 31 August 2026

    The government plans an extra review by an international firm.

  13. 2 October 2026

    The government announces limited reopening of the VwbP from 5 October and confirms the data was not changed.

How the attack worked

What officials say about the entry

On 4 August the government said forensics had found a potential entry point and called the attack targeted and technically skilled. On 19 August the head of the IT office gave a clearer picture: access to the data was possible because of faulty logic in the check of permissions.

He said the flaw let the application programming interface (API) be used through repeated single requests in a way that was not intended. He added that it was not a classic software vulnerability. Officials gave no more detail for investigative reasons.

Weak spot in the registration area

The security analysis found weaknesses in the registration area of the register. The fix announced is to put the national eID in front of account verification and identity checks, and to expand monitoring and detection so that unauthorized access is seen earlier.

What is not public

The sources do not describe the tools used, the number of requests, or how long the access lasted. No ATT&CK techniques are listed because no source names them.

Who says who was behind it

No public attribution. Official sources speak of an unknown actor ("unbekannte Täterschaft") and a criminal complaint against unknown persons (2 August 2026). The prosecutor's request of 6 August 2026 is also against unknown persons.

Impact

Data copies of about 31,000 legal entities were taken, including some deleted earlier (government, 2 August and FAQ). Data types: entity name and, for beneficial owners, role, name, first name, birth date, nationality and country of residence. The government says no addresses, phone numbers or financial data are held and that nothing was changed or deleted. The number of natural persons affected is not disclosed. The register was unavailable to external users until limited reopening on 5 October 2026. The eVAT portal, Lides, the central account register, Intax, the commercial register and the land registry software were taken offline as a precaution; the VAT filing deadline was extended to the end of September 2026. As of 2 October 2026 there was no sign the stolen data was published.

Government and regulator response

  • 30 July 2026: the IT office secured data and took the register offline.
  • 1-2 August 2026: crisis team formed, led by the head of government and the justice minister; the Office of Justice filed a criminal complaint against unknown persons.
  • 31 July to 10 August 2026: several state systems taken offline as a precaution and re-checked.
  • 4 August 2026: information line opened; legal entities asked to inform their beneficial owners, as the register holds no contact data. The government classed the event as a personal data breach under GDPR Article 33.
  • 6 August 2026: prosecutor asked the Princely Court for preliminary inquiries for unlawful access to a computer system and data theft.
  • 19 August 2026: security analysis completed; eID and stronger monitoring announced.
  • 31 August 2026: an extra external review by an international firm was planned.
  • 2 October 2026: limited reopening from 5 October with in-person identification; backups confirmed no data change; independent external review under procurement.

Lessons

  1. Permission logic is a target

    The government says the cause was faulty logic in checking permissions, not a classic software bug. Scanners may not find this kind of flaw.

  2. Repeated small requests can add up

    The API was used through repeated single requests. Rate limits and pattern alerts matter, not only blocking single bad calls.

  3. Registration and identity checks are an entry path

    The weak spot was in the registration area. Strong account verification, such as eID, is part of protecting a data service.

  4. Contain first, then widen

    Officials took the system offline within a day and then paused other systems as a precaution. Clear isolation of one service limited the wider risk.

  5. Registers without contact data make breach notice hard

    The register holds no addresses, so the state had to ask legal entities to inform their owners. Plan how you will notify people before a breach.

  6. Recovery can take weeks

    The register reopened only in limited form about ten weeks later, with in-person identification. Plan fallback processes for deadlines and filings.

What to check in your own organization

  1. Permission checks

    Test whether each API call checks the caller's rights on the server side, for every record, and not only at login.

  2. Request volume

    Check whether your APIs limit and alert on many single requests from one account or address in a short time.

  3. Account registration

    Review how new accounts are verified. Ask whether a stolen or fake identity could register and then query data.

  4. Data you hold

    List which personal data each public-facing service holds and whether it needs all of it.

  5. Isolation

    Confirm you can take one service offline fast without breaking others, and who decides.

  6. Breach notice plan

    Check that you can reach the people in your data, directly or through partners, within the time the law requires.

  7. Early warning

    Threat intelligence monitoring can watch for exposed credentials, new vulnerability alerts and stolen data offered or discussed in public places. In this case officials report no sign of publication as of 2 October 2026, and nothing here shows it would have flagged the API flaw. It can help show faster whether copied data surfaces.

Questions

What is the VwbP?

It is Liechtenstein's register of beneficial owners of companies, foundations and trusts, kept to prevent money laundering and terrorist financing.

How many were affected?

Data copies of about 31,000 legal entities, including some deleted earlier. The number of people is not disclosed.

What data was taken?

Entity name and, for beneficial owners, role, name, birth date, nationality and country of residence. The government says no addresses, phone numbers or financial data are held.

How did the attacker get in?

The government says faulty logic in the permission check let the API be used through repeated single requests. It said this was not a classic software vulnerability.

Who did it?

No public attribution. Officials speak of an unknown actor.

Is the register back?

Since 5 October 2026 in limited form, with in-person identification and reduced functions.

In our research

  1. Most targeted EU sectors in 2025: the ENISA ranking October 2026
  2. API Sprawl: The Attack Surface Nobody Put On the Inventory August 2026

Sources

  1. Unberechtigter Zugriff von Dritten auf Verzeichnisdaten (2 Aug 2026) Regierung des Fürstentums Liechtenstein
  2. Erste Erkenntnisse: Gezielter Angriff auf das VwbP (3 Aug 2026) Regierung des Fürstentums Liechtenstein
  3. Krimineller Angriff auf das VwbP: Potenzielles Einfallstor identifiziert (4 Aug 2026) Regierung des Fürstentums Liechtenstein
  4. Umfangreiche Überprüfung weiterer Systeme gestartet (5 Aug 2026) Regierung des Fürstentums Liechtenstein
  5. Liechtensteinische Staatsanwaltschaft beantragt gerichtliche Vorerhebungen (6 Aug 2026) Regierung des Fürstentums Liechtenstein
  6. Handelsregister vorübergehend vom Netz genommen (10 Aug 2026) Regierung des Fürstentums Liechtenstein
  7. Fristverlängerung für die Einreichung der MWST-Abrechnung (13 Aug 2026) Regierung des Fürstentums Liechtenstein
  8. Nach Cyberangriff: Sicherheitsanalysen abgeschlossen (19 Aug 2026) Regierung des Fürstentums Liechtenstein
  9. Nach Cyberangriff: Zusätzliche externe IT-Prüfung (31 Aug 2026) Regierung des Fürstentums Liechtenstein
  10. Nach Cyberangriff: Eingeschränkte Wiederaufnahme des Betriebs des VwbP (2 Oct 2026) Regierung des Fürstentums Liechtenstein
  11. Im Fokus: Cyberangriff auf das VwbP, FAQ Regierung des Fürstentums Liechtenstein
  12. Unauthorised third-party access to register data (English release, 2 Aug 2026) Government of the Principality of Liechtenstein
  13. Was ist passiert? Im Fokus: Cyberangriff auf das VwbP Regierung des Fürstentums Liechtenstein

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Data breach

A data breach is an event where someone gets access to information they are not authorized to see, or where authorized users use it for a purpose they were not allowed.

Read more

Glossary term

Leaked credentials

Leaked credentials are usernames, passwords or other login details that have become exposed outside the control of their owner.

Read more