In parallel, law enforcement in the European principality have handed in an initial report to public prosecutors and applied to start enquiries against those who may have carried out the attack.

“We understand the interest in the contents of the register. The information is subject to confidentiality, and the government therefore cannot provide any information on the data affected,” Prime Minister Brigitte Haas said in a 6 August statement.

The government said that on 5 August, a newly-formed crisis unit decided to take more systems offline. It had already taken four state systems offline as a precautionary move.

In line with GDPR regulations, legal entities have been informed to tell beneficial owners of the attack, the statement said.

The episode shows that government-run registers, databases and other information sources are vulnerable to attacks. This raises questions on whether the drive for transparency on beneficial ownership data can clash with security of that information. (See an analysis.)

The Crime Investigation Division of the National Police in Liechtenstein has already submitted a first investigation report to the Liechtenstein Office of the Public Prosecutor. The Office of the Public Prosecutor has applied to the Liechtenstein Court of Justice for preliminary inquiries against unknown perpetrators on suspicion of illegal access to a computer system, a 6 August statement from the government said.  

“The National Cyber Security Unit is in contact with the operators of critical infrastructures in order to assess the situation on an ongoing basis. The National Cyber Security Unit's inquiries to date give no indication that critical infrastructures are affected. Meanwhile, the prosecution authorities' investigations to find the perpetrators are proceeding urgently,” the government said.

The attack is a blow to Liechtenstein, a jurisdiction that received a “Largely Compliant” rating from the OECD in a report in June this year.