The Register Was Never the Wall.

On the night of 29–30 July 2026, unknown attackers obtained unauthorised digital access to Liechtenstein’s Register of Beneficial Owners — the Verzeichnis der wirtschaftlich berechtigten Personen, or VwbP — and copied data relating to approximately 31,000 legal entities. The Office of Justice noticed irregularities on 30 July; the Office of Information Technology secured the system and took it offline. Forensic analysis confirmed on 1 August that the attack had succeeded. The Government of the Principality made the incident public on Monday, 3 August 2026, describing it as a targeted attack at a high technical level and convening a crisis unit under Prime Minister Brigitte Haas and Minister of Justice Emanuel Schädler. Government of the Principality of Liechtenstein, media release, “Unauthorised third-party access to register data,” 3 August 2026, and the Government’s dedicated information page, “Cyberangriff auf das VwbP: Aktuelle Informationen”; see also “Cyberattack hits Liechtenstein’s anti-money laundering data register, Vaduz says,” Euronews, 3 August 2026, and “Hackers steal 31,000 records identifying people behind Liechtenstein companies, foundations,” The Record, 3 August 2026. Early informal accounts circulated a window of 28–30 July; the Government’s own account places the intrusion in the night of 29–30 July 2026, and that is the date used here.

As of the Government’s account, there is no indication that data in the system was altered or deleted, and no indication that other government systems were reached. The register remains unavailable to external users. The incident is being handled as a personal data breach under the General Data Protection Regulation, Art. 33, with the Government working toward notification of the individuals whose data was taken under Art. 34 and a dedicated contact point established for affected parties. Id.

That is the news. What follows is the part that matters to anyone who has ever been told that a structure is protected because the register holding it is confidential.

Liechtenstein’s register is not a public directory. It was built as the Principality’s implementation of the European anti-money-laundering framework — an original act in force from 1 August 2019, replaced by the current Act on the Register of the Beneficial Owners of Legal Entities (Gesetz über das Verzeichnis der wirtschaftlich berechtigten Personen, VwbPG) with effect from 1 April 2021, implementing the Fifth Anti-Money Laundering Directive, Directive (EU) 2018/843. It records the natural persons who ultimately own or control legal entities — companies, establishments, foundations and trusts — for the stated purpose of preventing money laundering and terrorist financing, and it is maintained electronically by the Office of Justice.

Access is layered and, on paper, disciplined. The Financial Intelligence Unit, the Financial Market Authority, the national police, the tax administration, the public prosecutor’s office, the Court of Liechtenstein and the Chamber of Lawyers may retrieve register data on an unrestricted basis in an individual case. Banks and other persons subject to due-diligence obligations, domestic and foreign, may obtain data on application to fulfil their customer due diligence. Other third parties may request disclosure in respect of a named entity, in writing, for a fee. NSF, “New rules on the UBO register in Liechtenstein — who will now have access to it? A brief overview,” 20 April 2021. The regime even contains an express shielding mechanism: disclosure may be restricted where a beneficial owner faces documented risks such as fraud, abduction or extortion. VwbPG; see Europe Fides, “Major overhaul of Act establishing Register of Beneficial Owners of Domestic Legal Entities (LIE).”

Pause on that last provision, because it is the most honest sentence in the whole architecture. The statute that compels disclosure contains, inside itself, an acknowledgement that disclosure can get people hurt. The drafters knew exactly what kind of information they were assembling in one place.

Then someone took a copy of it.

Liechtenstein has been here before, and the earlier episode is the more useful teacher because we know how it ended.

Between April 2001 and November 2002, an employee of LGT Treuhand — the fiduciary arm of the bank owned by the Princely family — was assigned to check documents being scanned into an electronic database. Before he left, he copied that client data. Years later he sold it. German intelligence is reported to have paid roughly €4.2 million for a data carrier identifying holders of Liechtenstein foundation interests; the resulting investigations became public in February 2008 with the prosecution of Klaus Zumwinkel, then head of Deutsche Post, and comparable data was reported to have been sold on to the United Kingdom, France, the United States, Canada, Australia and Italy. “The Robin Hood Of Taxes,” Forbes, 26 February 2008. Figures and mechanics are as reported in the press and are not independently verified here.

The clients on that list were not, for the most part, undone by the structures they had used. They were undone by the fact that a list existed.

And then German constitutional law delivered the second lesson. In a decision of 9 November 2010, 2 BvR 2101/09, the Bundesverfassungsgericht held that a residential search warrant in a tax-criminal investigation could constitutionally rest on the initial suspicion generated by that purchased, illicitly obtained Liechtenstein data. The questionable provenance of the material did not produce a bar on its use.

American practitioners should recognise the principle immediately, because it is older here. In Burdeau v. McDowell, 256 U.S. 465 (1921), the Supreme Court held that the Fourth Amendment restrains governmental action, and that the government may retain and use in a criminal prosecution incriminating papers that private individuals had stolen from their owner’s desk, without any government participation in the theft. The exclusionary rule is a remedy against the state. It is not a remedy against a burglar, and it is not a remedy against a hacker.

Combine the two propositions and you have the operating reality: data taken unlawfully from a register may still be used lawfully against the people named in it — by revenue authorities, by prosecutors, and, through ordinary discovery and investigative channels, by private litigants who come to know what to ask for. The 2010 German decision and the 1921 American decision are ninety years apart and point the same direction.

Set the breach aside for a moment. Even had the VwbP never been touched, the confidentiality of European beneficial-ownership data has been visibly unstable for a decade.

The Fifth Anti-Money Laundering Directive required Member States to open beneficial-ownership registers to any member of the general public. In November 2022, the Grand Chamber of the Court of Justice of the European Union held that provision invalid, finding the general-public access regime a serious interference with the rights to private life and to protection of personal data that was neither strictly necessary nor proportionate. WM and Sovim SA v Luxembourg Business Registers, Joined Cases C-37/20 and C-601/20, Judgment of the Court (Grand Chamber) of 22 November 2022 (declaring invalid Article 30(5), first subparagraph, point (c) of Directive (EU) 2015/849 as amended by Directive (EU) 2018/843). Registers across Europe suspended public access within days.

The pendulum has since swung back to an intermediate position. Under the 2024 anti-money-laundering package — Regulation (EU) 2024/1624 and Directive (EU) 2024/1640, adopted 31 May 2024, with the Regulation applying from 10 July 2027 — access is to be granted not to the world at large but to competent authorities, the new EU anti-money-laundering authority, obliged entities, and persons who can demonstrate a legitimate interest, a category expressly framed to include journalists and civil-society organisations, with the national registers interconnected.

So in the space of roughly eight years, the same underlying data has been: confidential; then public by directive; then abruptly closed by judicial invalidation; then reopened to a defined class including the press, with cross-border interconnection to follow. Whatever else that is, it is not a stable promise of secrecy. It is a policy setting, and policy settings move.

A structure whose protective value depends on a policy setting is not protected. It is merely undisturbed.

Clients who read about a registry breach tend to collapse the exposure into one vague worry. It is worth separating it.

First, discovery risk. A copied beneficial-ownership register is, functionally, an asset map. It links a named natural person to a set of entities across a jurisdiction. For a judgment creditor, a divorcing spouse, or a plaintiff’s firm running an asset investigation, that linkage is the single most expensive thing to develop and the single most valuable thing to obtain. Data of this kind does not stay in the hands that took it; it is traded, resold, and eventually surfaces in the commercial intelligence market that litigation-support firms buy from. The realistic planning assumption is that anything in that register may in time be known to an adversary, without any subpoena and without any letter rogatory.

Second, personal-safety and extortion risk. This is the risk the VwbPG’s own shielding provision contemplates. A file that identifies wealthy individuals, their families’ addresses and their holdings is a targeting list for extortion, fraud, and worse. It is a different problem from asset protection, it is not solved by trust drafting, and it belongs in a conversation with security and privacy advisers rather than in a structure chart.

Both risks are made worse — sharply worse — by inaccurate filings. If what is on file about a client is stale, incomplete or wrong, the breach has not merely exposed them; it has exposed them in a form that a hostile reader will characterise as concealment. Which brings us to the point of this series.

The recurring argument in these pages is that durable protection has three structural properties, and that none of them is secrecy.

Protection must be seasoned — established years before any claim was in contemplation, so that the timeline itself answers the accusation. Protection must be irrevocable and genuinely discretionary — so that there is no retained interest or retained control for a court to attach, and no enforceable right the client can be ordered to exercise. And protection must be independently administered — so that when the question comes, as it always does, “whose assets are these really?”, the administrative record answers it in someone else’s handwriting.

Every one of those properties works in the open. A trust settled eight years before the dispute is exactly as protective when the creditor knows about it as when he does not — arguably more so, because the timeline is the defence. A properly discretionary trust with an independent trustee does not become reachable because its existence is disclosed. Disclosure is not the vulnerability; retained control is the vulnerability, and retained control is discoverable whether or not a register is breached.

Contrast the improvised alternative. The transfer to a spouse three weeks after the demand letter. The nominee who holds “for convenience.” The entity whose registered particulars do not match how it is actually operated and funded. These arrangements have exactly one defensive mechanism: nobody looks. When somebody does look — through a breach, through a leak, through discovery, through an ex-employee, through an interconnected register in 2027 — the arrangement does not merely fail. It converts. The very facts that were meant to hide the asset become the badges a court uses to find the intent: the insider relationship, the retained benefit, the concealment itself, the suspicious timing. Uniform Voidable Transactions Act § 4(b) (formerly the Uniform Fraudulent Transfer Act) sets out the non-exclusive badges of fraud from which actual intent to hinder, delay or defraud a creditor may be inferred, including whether the transfer was to an insider, whether the debtor retained possession or control of the property after the transfer, whether the transfer was concealed, and whether it was made after the debtor had been sued or threatened with suit; analogous inquiries exist in the voidable-transaction and actio Pauliana regimes of the civil-law and offshore jurisdictions in which these structures are typically sited, though the specific elements, burdens and limitation periods differ materially by jurisdiction. Improvised shielding does not produce protection. It produces evidence, and a breach is simply the day that evidence gets delivered.

That is the asymmetry worth carrying into every client conversation. A sound structure loses nothing when it becomes known. An unsound one loses everything.

One consequence of registry exposure is a category error that clients — and, in the first instance, adversaries — make constantly.

A register entry is a compliance classification, not an adjudication of property rights. Anti-money-laundering frameworks deliberately cast a wide net: the current Liechtenstein regime, for example, requires foundations and trusts to register their beneficiaries irrespective of whether those beneficiaries exercise any control at all. A person can therefore appear in the VwbP as the registered beneficial owner of a structure in which, as a matter of the governing trust law, they hold no proprietary interest whatsoever — merely a discretionary expectancy that no court can compel a trustee to satisfy.

That distinction is invisible on the face of a leaked spreadsheet. Expect the spreadsheet to be read aggressively — “the file says he owns it” — and expect that reading to appear in a complaint. The answer to it is not secrecy; it is the trust instrument, the trustee’s exercise of discretion, and the administration record. Which is to say: the answer is a structure built properly in the first place, documented well enough that its true legal character can be shown to a court that has already been handed the leaked file.

It would be a mistake for US-connected clients to file this away as a European problem.

The United States built its own beneficial-ownership database under the Corporate Transparency Act, and then narrowed it dramatically: FinCEN’s interim final rule, published on 26 March 2025, exempted entities formed in the United States and US persons from beneficial-ownership reporting, leaving only foreign entities registered to do business in the country as reporting companies. That rule remains an interim rule, not a final one; a final rule had not been issued as of the date of this note. At state level, New York’s LLC Transparency Act took effect on 1 January 2026 with a confidential, non-public beneficial-ownership database; the Governor vetoed decoupling legislation in December 2025, and the Department of State has taken the position that LLCs formed in the United States are consequently outside the filing requirement, leaving foreign LLCs authorised to do business in New York to file, with those authorised before 2026 given until the end of that year. See Holland & Knight, “New York LLC Transparency Act: Reporting Limited to Non-U.S. LLCs,” January 2026.

Two observations follow. The first is that the current American position is a policy reprieve, granted by an interim rule and a veto, both of which can be revisited by the next administration, the next legislature, or the next final rule. The second is that where these databases do exist, they are confidential in precisely the way Liechtenstein’s was confidential — which is to say, confidential until a sufficiently capable attacker decides otherwise. A “secure, nonpublic database” is a description of intent, not a guarantee of outcome.

• Assume publication. Test every structure against a simple question: if the register entry, the entity chart and the funding history were printed in a newspaper tomorrow, does the plan still work? If the answer depends on nobody knowing, it is not a plan.
• Know what is on file. Many clients have never read their own registrable-person filings. Pull them. Confirm they are accurate and current in every jurisdiction. An inaccurate filing that surfaces in a breach is far worse than an accurate one.
• Season, relinquish, and delegate. The three properties that survive disclosure — established well before any claim, genuinely irrevocable and discretionary, independently administered — are the only ones that do.
• Do not confuse a register entry with ownership. Registration as a beneficial owner under an anti-money-laundering statute is not a proprietary interest. But be ready to prove that, with instruments and administration records, to a reader who already has the file.
• Stolen data can still be used. Illicit provenance has not historically produced an evidentiary bar — not in the German courts in 2010, not under American Fourth Amendment doctrine since 1921. Plan on the assumption that whatever is taken can be used.
• Treat personal security as a separate workstream. Exposure of names, addresses and holdings creates physical and extortion risk that no trust deed addresses.

Liechtenstein will restore its register, harden its systems, and notify the people whose data was copied. The Principality’s institutions are serious and its response has been prompt. None of that returns the data.

For clients, the durable lesson is the one this series keeps returning to from different directions. Secrecy is a wasting asset — it depreciates with every directive, every court ruling, every disgruntled employee and every breach. Structure is not. A trust that was funded years ago, that the settlor cannot revoke, that a genuinely independent trustee actually administers, and whose paperwork tells one consistent story, is worth exactly as much on the day it appears in a leaked file as it was the day before.

Build it so that it does not matter who is reading.

This note is general commentary on published developments and is not legal, tax or security advice for any particular person or structure. Outcomes turn entirely on the facts and on the law of the relevant jurisdictions, and any specific situation should be assessed with qualified counsel in each jurisdiction concerned.