Liechtenstein says cyberattack exposed beneficial ownership registry data

Liechtenstein said hackers illegally accessed and copied data from its Register of Beneficial Owners, exposing information tied to about 31,000 people and about 31,000 companies, foundations and other legal entities. The breach hit one of the principality’s most sensitive transparency databases, the system meant to identify who really controls structures often used to hold wealth.

Officials said the unauthorized access happened during the night of July 30, and the theft was disclosed Aug. 2 and Aug. 3. The government said the stolen material included names, addresses and dates of birth, but not passwords or banking details. Even so, the incident put a registry built for trust and compliance at the center of a cybercrime case in one of Europe’s smallest states.

The register is administered by the Liechtenstein Office of Justice and is maintained to prevent money laundering, predicate offenses to money laundering and terrorist financing. It is also the sort of database banks, investigators and compliance officers use to trace links among shell companies, trusts and foundations, making it a key part of the machinery used to police hidden wealth. Liechtenstein’s disclosure rules have been tied to European Union anti-money-laundering directives and updated over time as governments have pushed for more ownership transparency.

That makes the breach larger than a domestic IT problem. Liechtenstein is a financial center in the Alpine region, and its corporate and foundation structures have long drawn scrutiny because they sit at the intersection of private wealth, cross-border services and regulatory oversight. In a country with a population of about 41,000, data connected to roughly 31,000 people and 31,000 legal entities touches a huge share of the economy’s public-facing identity.

The immediate questions now go beyond how the attackers got in. Banks, auditors and international partners rely on clean beneficial-ownership records to assess money-laundering, sanctions and tax-evasion risks, and any compromise of that database can shake confidence in the information they depend on. Even without banking credentials, the exposure of names, addresses and birth dates raises the cost of safeguarding the registries governments increasingly use to expose who stands behind companies and foundations.