Liechtenstein: data on 31,000 companies and foundations stolen

The government of Liechtenstein announced on Tuesday that investigators had identified a possible access point used in a cyberattack. The target was the Principality's register of beneficial owners.

The attack is described as technically sophisticated and directed against a security structure described as highly complex.

Around 31,000 records relating to companies, foundations and trusts were compromised. The information taken includes the names of legal entities, along with names, dates of birth, citizenship and country of residence of the beneficial owners.

What was not taken

The government states that other data were not affected. Addresses, telephone numbers and financial information such as revenue, assets or dividends were not stolen.

Those responsible for the attack remain unknown. The authorities indicate that this was an isolated and targeted incident.

For security reasons other sensitive data were temporarily removed from the network.

The register of beneficial owners exists to make identifiable the natural persons behind companies and legal structures. It is an instrument created for transparency and for combating money laundering.

That very function is what makes the data attractive to those who steal it. A list linking people's names to legal entities has a value beyond any individual personal detail, because it reconstructs relationships that are otherwise invisible.

Liechtenstein hosts a high number of foundations and asset structures relative to its size. The reach of the incident therefore also concerns beneficial owners resident in other countries.

The government has not said when the data were taken, nor how long access remained open to those responsible. Such details normally emerge in the later stages of technical analysis.