The exfiltration of the register on 30 July is not a Liechtenstein IT story, it is a client story. 31,000 legal entities are affected and the data cannot be recalled. The individuals behind those structures chose this jurisdiction in part for the privacy it offered. Trustees, advisers and counsel now face questions on notification, targeted fraud and physical security that have no off-the-shelf answer.

A name is now enough.

The register connects names to structures. Public sources supply the rest: the address, the family, the daily pattern. AI tools put all necessary information within reach of criminals at any level of sophistication. From there the exposure is human rather than technical. A caller who knows the foundation, its council or family details need not be convincing, and a cloned voice or a familiar face on a video call now costs nothing to produce.

The extraction tool is crypto. The target need not hold any.

A ransom in digital assets settles in minutes, crosses borders without a bank, and cannot be reversed. Where the client holds no digital assets, the attacker forces the purchase. Conservatively structured, illiquid wealth no longer protects as it once did, because the constraint on extraction is no longer the asset. It is the person, and the people around them. The precedent is not hypothetical. In France, a tax official sold official data to criminals who used it to select kidnapping targets. The pattern is not confined to France. A database of physical attacks involving cryptocurrency records 378 reported attacks across
58 countries and 30 fatalities, with reported attacks up
81 per cent last year. (Gart Research, stats.gart.io)

The structure still works. The privacy around it does not.

The response is layered, and the layers work only together: structural questions with counsel, digital security at the firm and around the family, protocols and training for the principals and the people close to them. The briefing covers all three, and how they apply to a book of clients where not every file carries the same risk.

Gart and partners invite you to

a half-day briefing in Vaduz on [date].