Cyberattack in Liechtenstein: Austria Also Affected

Overview

At the end of July 2026, Liechtenstein’s Register of Beneficial Owners (“VwbP”) was targeted as part of a cyberattack on the Liechtenstein Office of Justice. As yet unidentified perpetrators succeeded in unlawfully obtaining copies of data relating to around 31,000 companies, foundations, trusts and other legal entities.

The incident is relevant to Austria insofar as persons resident in Austria are recorded in the VwbP as beneficial owners of Liechtenstein companies, foundations or trusts.

What Happened in the Liechtenstein Cyberattack?

According to the preliminary findings, the unidentified perpetrators gained unauthorised electronic access to the VwbP maintained by the Office of Justice during the night of 29 to 30 July 2026.

The Register of Beneficial Owners was introduced in Liechtenstein in 2021 pursuant to the requirements of the Fifth EU Anti-Money Laundering Directive. It contains the names of legal entities as well as personal data relating to their beneficial owners. For these purposes, legal entities include companies, foundations and trusts.

The perpetrators were able to obtain copies of data relating to around 31,000 legal entities. Based on the information currently available, however, there are no indications that any data held in the system were altered or deleted.

Which VwbP Data Are Affected and Why Is the Incident Relevant to Austria?

The VwbP records the name of the legal entity as well as the surname, first name, date of birth, nationality and country of residence of its beneficial owners.

As expressly clarified by the Liechtenstein Government, the Register contains neither addresses nor telephone numbers, nor financial data such as revenue, assets or dividends.

However, the association of a natural person with a Liechtenstein company, foundation or trust is particularly sensitive. When combined with other information, the data may be used to make apparently credible attempts to contact the persons concerned and to facilitate criminal activities.

For Austria, the incident is particularly relevant in connection with Liechtenstein sub-foundations, sub-establishments and interests held by Austrian foundations, as well as other Liechtenstein foundations with an Austrian nexus. Natural persons may be affected in particular where they were recorded in the VwbP as beneficial owners of a Liechtenstein legal entity, including founders, beneficiaries or members of governing bodies.

In this context, it should be emphasised that the establishment of foundations, including sub-foundations, and other legal entities in Liechtenstein is lawful. Where structures have been established with appropriate professional advice and in compliance with applicable law, there is generally no cause for concern, even if Austrian authorities gain access to the data unlawfully obtained in the attack. Nevertheless, depending on the circumstances of the individual case, it may be advisable to review existing Liechtenstein foundation structures from an Austrian tax perspective in order to identify any potential risks—particularly as regards their classification for tax purposes as transparent or non-transparent foundations—and to determine whether any action is required.

Conclusion

The VwbP cyberattack concerns copies of data relating to around 31,000 Liechtenstein legal entities and their beneficial owners. The data concerned include, in particular, the names, dates of birth, nationalities and countries of residence of beneficial owners, as well as their association with specific legal entities. According to the Liechtenstein Government, addresses, telephone numbers and financial data such as revenue, assets or dividends were not recorded in the VwbP.

According to information provided by the Liechtenstein Government, affected persons will be informed through the legal entities concerned. Persons resident in Austria who are connected with Liechtenstein foundations or other legal entities, for example as founders, beneficiaries or members of governing bodies, as well as Austrian foundations with Liechtenstein structures, should therefore liaise with their relevant contacts to determine whether they are affected.

The Liechtenstein Government has set up the dedicated information email address vwbpfragen@llv.li at the Liechtenstein Office of Justice.

For assistance in determining whether a person or entity may be affected, or in analysing Liechtenstein foundation structures from an Austrian tax perspective, Dr. Christian Wilplinger and Mag. Georg Lenhardt are available for consultation.