EMET NEWS PRESS

Situation Assessment I

Employees of the Office of Justice detected irregularities in the register on 30 July and contacted the Office of Information Technology. The technical review strengthened the initial suspicion of a successful intrusion. The government was informed of a potentially successful attack on 31 July. Initial confirmed findings reached the political leadership on the afternoon of 1 August, and the crisis team began work that evening.

The official statement places the breach at approximately 31,000 legal entities. This figure refers to companies, foundations and trusteeships. It does not necessarily represent the number of extracted files, individual records or affected natural persons. A definitive assessment of the compromised volume has yet to be published.

Martin Alge, head of the Office of Justice, stated in reports by SRF and ORF that personal data belonging to beneficial owners had been affected. The reported fields included names, dates of birth and nationalities. Media accounts differ regarding individual data categories. The government has yet to release a complete field-level assessment.

Brigitte Haas stated that authorities had received no ransom demand and had found no indication that the records were being offered for sale on the dark web. This establishes the limits of the public evidence. It provides no basis for attribution to cybercriminals, state intelligence services or politically motivated actors.

Situation Assessment II

The attack affected a central data system within Liechtenstein’s financial and judicial architecture. The register assists public authorities and entities subject to anti-money-laundering obligations in identifying beneficial ownership. The loss of confidentiality therefore extends beyond a conventional theft of personal data.

Use of the term critical infrastructure requires legal precision. Liechtenstein’s Cyber Security Act covers central public administration regardless of organizational size and classifies it as an essential entity. The Office of Justice forms part of the national administration. The attack consequently affected an administrative sector subject to enhanced statutory protection. No disruption of energy, water, telecommunications or other conventional critical services has been documented.

Confirmed effects comprise data exfiltration and the temporary loss of external access to the register. Authorities have reported no manipulation of the database, compromise of additional government networks or disruption of financial transactions. The technical scope will remain unresolved until investigators determine the point of entry, dwell time and any persistence established inside the environment.

Strategic Value of the Dataset

The register is more than a collection of isolated personal identifiers. It links natural persons to legal structures and identifies the individuals exercising economic control. For intelligence analysis, this creates a relational dataset capable of exposing ownership networks, fiduciary relationships and spheres of financial interest.

Its value increases through data fusion. Combining the records with commercial registers, publicly available corporate information or known financial transactions could reveal connections that remain concealed when the sources are examined separately. Even limited identity fields may enable reliable matching against larger commercial databases or unlawfully obtained collections.

A state actor could use the records for economic and financial intelligence. Potential objectives include identifying politically exposed persons, reconstructing foreign asset structures and locating networks involved in sanctions evasion. Criminal actors could exploit the same information for extortion, identity fraud or targeted deception. Current evidence supports none of these hypotheses as the confirmed motive.

Implications for Anti-Money-Laundering Operations

The register establishes which natural persons control or benefit economically from a legal entity. This information provides a starting point for customer due diligence and the examination of suspicious transactions. The extraction of a complete or nearly complete copy could therefore reveal the extent of ownership information available to Liechtenstein’s authorities.

A capable actor could examine which relationships have already been registered and restructure future holdings accordingly. Possible responses could include replacing exposed intermediaries, transferring assets through other legal entities or shifting structures to different jurisdictions. Authorities have reported no such activity.

The outage may also affect banks, trustees and other regulated entities if their compliance procedures depend on current register information. The government has not disclosed the availability of alternative verification procedures or whether ongoing due-diligence reviews have been delayed.

Exposure of the Financial Centre

Liechtenstein combines a compact public administration with an internationally oriented financial, foundation and trust sector. This creates functional concentration within a limited number of government systems. Compromise of a single register can consequently expose a substantial share of the nationally relevant ownership data.

The immediate economic effect will depend on the duration of the outage and subsequent use of the information. If the incident remains confined to a confidentiality breach and a limited interruption, the operational consequences are likely to remain manageable. Publication, extortion or confirmed manipulation would materially increase the severity.

The incident also creates reputational exposure. Liechtenstein has strengthened its international regulatory position through expanded transparency and anti-money-laundering controls. A breach of the principal beneficial-ownership register may raise concerns over the state’s capacity to protect the sensitive information required by those controls.

Potential Actor Interests

Financially motivated cybercriminals could use the records to target beneficial owners or prepare fraud operations. The concentration of asset-management structures raises the potential value of accurate targeting information. The absence of a ransom demand currently weakens the hypothesis of a conventional extortion campaign, although later contact remains possible.

A state or state-directed actor could seek to identify the financial interests of foreign political figures, officials or companies. Register data can be fused with intelligence derived from travel, communications or financial transactions. Such an operation may serve long-term collection objectives and would require no public release.

Politically motivated actors could publish selected records to damage the financial centre or individual persons. Selective disclosure would also permit narrative manipulation by placing authentic data into incomplete or falsified contexts. No evidence of such an information operation has emerged.

Risk of Manipulation and Follow-on Operations

The government has found no indication that the records were changed or deleted. The confirmed compromise therefore concerns confidentiality, while a loss of integrity remains unproven. Restoration of service will depend on whether investigators can verify privileged accounts, access logs and connected systems.

The stolen information supports targeted social engineering. Attackers could refer to genuine ownership relationships when contacting trustees, banks or beneficial owners, increasing the credibility of fraudulent requests. Likely objectives would include obtaining additional documents, credentials or payment authorizations.

Follow-on activity could also target employees responsible for the register or external service providers. The possible involvement of third-party infrastructure in the original breach remains unknown. Until the initial access vector is established, the probability of renewed compromise cannot be assessed reliably.

Comparable Global Incidents

The 2019 attack against Bulgaria’s National Revenue Agency provides the closest state-level comparison. Attackers extracted tax and identity data concerning several million individuals. The OECD Global Forum confirmed that the compromised material included information received from foreign partner states through the Common Reporting Standard. The case demonstrated how an intrusion into a national financial authority can create immediate cross-border notification and confidence effects.

The compromise of the United States Department of the Treasury in late 2024 presents a different actor profile. The Treasury linked a Chinese cyber operator to the intrusion and associated him with the Chinese Ministry of State Security. The case illustrates the intelligence value that state actors assign to government financial and sanctions-related systems. No evidence currently connects the Liechtenstein operation to a comparable state-directed campaign.

The 2022 Conti attacks against Costa Rica represent an availability-focused operation against state capacity. Ransomware disrupted systems belonging to the Ministry of Finance and customs administration. Costa Rica subsequently declared a national emergency. The Liechtenstein breach remains below this level of operational impact because authorities have reported no cross-government disruption or widespread encryption.

The 2016 Panama Papers provide a comparison for the consequences of large-scale exposure of beneficial-ownership information. The 11.5 million documents from the Mossack Fonseca environment revealed connections involving more than 214,000 offshore entities. The source of the leak was never conclusively established as an external cyberattack. The case nevertheless demonstrates the political, legal and financial consequences that can follow public analysis of structured ownership records.

The 2020 FinCEN Files were also distinct from the Liechtenstein intrusion. The disclosed material included more than 2,100 suspicious activity reports addressing transactions worth over two trillion US dollars. Their strategic relevance lies in the exposure of analytical methods, banking relationships and suspicions held within the global anti-money-laundering system. Publication of Liechtenstein’s records could similarly reveal which ownership structures were visible to public authorities.

Comparative Assessment

The international precedents present several distinct impact models. Bulgaria represents mass extraction from a sovereign financial database. Costa Rica demonstrates the disruption of government functions through ransomware. The US Treasury compromise illustrates strategic financial collection attributed to a state-linked actor.

The Panama Papers and FinCEN Files demonstrate a further impact category. Once financial records become public, they can generate political, judicial and diplomatic consequences lasting far beyond the initial security breach. The decisive indicator for Liechtenstein will therefore be whether the copied data remain under covert exploitation, enter criminal markets or become publicly accessible.

Current evidence supports classification as a mass exfiltration operation against a government financial and administrative database. Its operational impact remains below the Costa Rican precedent. Publication of the records could expand the damage beyond the present data-protection incident.

Structural Exposure of Small States

Small states frequently combine short administrative decision paths with highly centralized digital services. This structure can support rapid crisis management while increasing the concentration value of individual systems. A single successful intrusion may expose a large proportion of the nationally relevant dataset.

Liechtenstein is also deeply integrated into cross-border financial and legal relationships. Affected beneficial owners, legal entities and financial institutions may therefore be distributed across numerous jurisdictions. The country’s geographic size provides no reliable indication of the international reach or strategic value of the compromised information.

In May 2025, the government informed the Landtag that the Office of Information Technology had expanded its cybersecurity personnel since 2021 and established specialist units for network security and cloud services. The present incident does not yet permit a definitive assessment of those measures. Such an assessment requires technical reconstruction of the access vector, defensive controls bypassed and institutional response time.

Legal and Reporting Framework

The Cyber Security Act requires essential entities to report significant incidents immediately to the National Cyber Security Unit. The framework requires an early warning within 24 hours and a detailed incident notification within 72 hours of awareness. A final report is generally required within one month of the initial notification.

The published chronology does not allow a definitive assessment of compliance with the internal reporting deadlines. The government stated that the Office of Justice identified irregularities on 30 July and that the political leadership was informed of a potentially successful attack the following day.

The government also classified the incident as a personal-data breach under the General Data Protection Regulation. Article 33 governs notification of the supervisory authority. Article 34 requires notification of affected persons when the breach is likely to create a high risk. The crisis team is preparing these notifications according to the official statement.

Intelligence Assessment

The selection of the register indicates a focused interest in economic ownership and control relationships. Its structured content offers greater intelligence value than isolated personal identifiers. Data fusion could support the reconstruction of asset networks and international financial connections.

Criminal exploitation, strategic financial intelligence and future politically motivated disclosure remain viable working hypotheses. The absence of a ransom demand reduces the current visibility of a conventional ransomware or extortion model. Attribution to a state actor would remain speculative without forensic indicators.

The strongest confirmed effect is the exfiltration of register data. The external outage remains functionally limited. Authorities have reported no systemic disruption of the financial sector or compromise of additional government services.

Observable warning indicators include publication on dark-web platforms, contact with registered individuals and increased phishing activity against trustees or financial institutions. Further indicators would include transfers of affected legal entities, fraudulent requests to amend register entries or anomalies in connected government systems. Technical reconstruction of the initial access remains essential for reliable attribution.

Glossary

Common Reporting Standard
International framework for the automatic exchange of financial-account information for tax purposes.

Cyber Security Act
Liechtenstein legislation implementing NIS 2 requirements and regulating essential and important entities.

Dark web
A non-indexed area of the internet used, among other purposes, for trading stolen data.

Data exfiltration
Unauthorized transfer of information from a compromised system.

Data fusion
Combination of separate datasets to generate additional intelligence.

Indicators of compromise
Technical evidence indicating a successful or continuing intrusion.

Critical infrastructure
Infrastructure and administrative services whose disruption may significantly affect the state, economy or population.

NIS 2 Directive
European legal framework designed to raise the common level of cybersecurity.

Social engineering
Manipulation of individuals to obtain information, system access or authorization.

Register of Beneficial Owners
Government register identifying the natural persons who economically control legal entities.

Persons Register

Brigitte Haas
Prime Minister of Liechtenstein and joint head of the crisis team.

Emanuel Schädler
Liechtenstein’s Minister of Justice and joint head of the crisis team.

Martin Alge
Head of the Office of Justice; publicly described the affected dataset.

References

Government of the Principality of Liechtenstein
Unauthorized third-party access to register data
2 August 2026
regierung.li/medienportal-medium/16182/234653/medienmitteilung

Liechtenstein Legal Gazette
Cyber Security Act of 5 December 2024
5 December 2024
gesetze.li/konso/pdf/2025111000?version=2

Landtag of the Principality of Liechtenstein
Minor interpellation: Cyberattacks against Liechtenstein
9 May 2025
landtag.li/printkleineanfrage/28718

Swiss Radio and Television
Cyberattack on economic data in the Principality of Liechtenstein
2 August 2026
srf.ch/news/international/hackerangriff-cyberangriff-auf-wirtschaftsdaten-im-fuerstentum-liechtenstein

ORF Vorarlberg
Data stolen from foundation register
2 August 2026
vorarlberg.orf.at/stories/3365299

OECD Global Forum on Transparency and Exchange of Information for Tax Purposes
Statement on the data breach in the National Revenue Agency of Bulgaria
30 August 2019
oecd.org/en/networks/global-forum-tax-transparency/news-events/2019/statement-on-the-data-breach-in-the-national-revenue-agency-of-bulgaria.html

NATO Cooperative Cyber Defence Centre of Excellence
Costa Rica ransomware attack
20 March 2023
cyberlaw.ccdcoe.org/wiki/Costa_Rica_ransomware_attack_(2022)

United States Department of the Treasury
Treasury sanctions company associated with Salt Typhoon and hacker associated with Treasury compromise
17 January 2025
home.treasury.gov/news/press-releases/jy2792

International Consortium of Investigative Journalists
About the Panama Papers investigation
3 April 2016
icij.org/investigations/panama-papers/about-the-investigation

International Consortium of Investigative Journalists
About the FinCEN Files investigation
19 September 2020
icij.org/investigations/fincen-files/about-the-fincen-files-investigation