Loading story…
Liechtenstein disclosed an unauthorized intrusion into its VwbP register, the national database of beneficial owners used for anti-money laundering and counter-terrorism financing compliance, after attackers exfiltrated copied data tied to about 31,000 legal entities and their beneficial owners. Government statements said the intrusion occurred during the night of July 30 and that the stolen records may affect a substantial share of the country’s residents, given Liechtenstein’s population of roughly 41,000. Authorities said there was no evidence that data in the register had been modified or deleted.
The government temporarily disabled external access to the register through llv.li, classified the incident as a personal data breach under GDPR Article 33, and said affected individuals would be notified under GDPR Article 34. A crisis team led by Prime Minister Brigitte Haas, with Justice Minister Emanuel Schädler involved, was convened to manage the response. Public reporting described the stolen information as covering all economically beneficial owners recorded in the system, while the responsible threat actor, intrusion method, and specific compromised infrastructure have not been identified.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
On August 2, 2026, Liechtenstein formally confirmed the crisis cell led by Prime Minister Brigitte Haas and Justice Minister Emanuel Schädler. Authorities also made the VwbP register temporarily inaccessible to external users via llv.li and said affected persons would be notified under GDPR procedures.
On August 2, 2026, the Government of Liechtenstein publicly announced that an unauthorized intrusion had affected the VwbP system. It said copied data relating to about 31,000 legal entities and their beneficial owners had been exfiltrated, with no evidence at that stage of data modification or deletion.
On the afternoon of August 1, 2026, authorities transmitted initial confirmed findings about the VwbP breach to the government. The same evening, a crisis cell was formed to coordinate the response.
The government was informed on July 31, 2026 that the incident may have been a successful cyberattack. This marked the escalation from technical irregularities to a suspected confirmed compromise.
On July 30, 2026, the Office of Justice detected irregularities in the VwbP system and contacted the Office of Information Technology. Authorities immediately implemented protective measures and disconnected the register from the network.
An unknown actor illegally accessed Liechtenstein's VwbP beneficial-owners register during the night of July 30, 2026. The intrusion ultimately led to the exfiltration of copied data tied to about 31,000 legal entities and their beneficial owners.
Unknown attackers accessed Liechtenstein's Register of Beneficial Owners for a two-day period beginning on July 29, 2026. The later investigation found data tied to about 31,000 entities was exfiltrated during the intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcetherecord.media
Open sourcesecurityweek.com
Open sourcevaterland.li
Open sourcemalware.news
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lithuanian prosecutors are investigating a major breach of the state registry systems after attackers used login credentials assigned to authorized institutions to access more than 600,000 records held by the Centre of Registers. The intrusion affected the Real Estate and Legal Entities Registers and exposed sensitive personal and property data, including names, dates of birth, national identification numbers, addresses, cadastral information, and registry numbers. Authorities said the breach was detected in early April, but disclosure was delayed while the criminal investigation proceeded, and the estimated financial damage exceeds **€111,000**. Lithuania has blocked suspected accounts and ordered credential changes as it works to contain the incident, while questions over the security of state IT systems intensified. Centre of Registers chief **Adrijus Jusas** resigned following the leak and said years of underinvestment had left government platforms in need of as much as **€60 million** in cybersecurity upgrades. Officials have not publicly attributed the attack or identified a responsible threat actor, despite political claims that the operation may show signs of foreign, possibly Russian, involvement.
Jun 29, 2026
Latvia’s Road Traffic Safety Directorate (**CSDD**) confirmed that attackers stole historical payment receipt data affecting more than **1.2 million people** and **200,000 businesses and legal entities**, making it one of the country’s largest reported public-sector data breaches. Exposed records reportedly included personal or company identification numbers, vehicle license plate numbers, payment amounts and dates, names, and some registered address information tied to service interactions, while officials said usernames, passwords, phone numbers, and email addresses were not compromised. Latvian authorities said the intrusion was a targeted, technically sophisticated attack that exploited an internet-exposed vulnerability in a CSDD system, and CERT.LV indicated mandatory cybersecurity requirements had not been fully met. The breach prompted criminal proceedings, investigations by cybersecurity and data protection authorities, and sharp political fallout: President Edgars Rinkevics and lawmakers called for accountability, CSDD’s supervisory board resigned, and agency chief Aivars Aksenoks said he would step down after response work concludes. Prime Minister Andris Kulbergs described the incident as a national security issue, said foreign involvement could not be ruled out, and criticized delays in notifying the government.
Aug 20, 2026
Lidl disclosed a customer data breach affecting users of its online shop in **Germany, Belgium, and the Netherlands** after attackers compromised an external IT service provider and briefly accessed a separately stored file. The retailer said its online shop systems were **not** breached directly, but the exposed data includes customer names, telephone numbers, email addresses, dates of birth, salutations, and customer numbers. Lidl said it cannot yet rule out exposure of passwords, billing and delivery addresses, bank details, or other payment information, although it has not reported concrete evidence of misuse so far. The service provider has restored system security, filed a police report, and engaged forensic experts, while Lidl notified the relevant data protection authority, including the Dutch regulator, and warned affected customers to watch for phishing attempts and identity fraud.
Jul 18, 2026