The cyberattack on Liechtenstein’s beneficial ownership register has put the security of these databases under new scrutiny, days after Bermuda clarified the circumstances in which journalists and other applicants can get access to its own register.

Liechtenstein’s Government said unknown attackers gained unauthorised access to its Register of Beneficial Owners of Legal Entities on July 30 and copied data relating to about 31,000 legal entities, including companies, foundations and trusts.

The information affected included the entities’ names and beneficial owners’ roles, names, dates of birth, nationalities and countries of residence, according to the government.

It said there was no indication that data had been changed or deleted, but the register was taken offline as a precaution while its integrity and security are reviewed. The government also started a crisis unit, notified the data-protection authority and began criminal proceedings against unknown perpetrators.

The incident did not involve bank client records, account information or data held by financial institutions, Liechtenstein’s government said. However, the scale of the breach show how sensitive the information held in these registries can be. Beneficial ownership registries are intended to help authorities identify the people who ultimately own or control businesses and legal entities.

Bermuda’s central register is not public. Recent changes to the Beneficial Ownership Act allow the Registrar of Companies to disclose prescribed information to people who can demonstrate a legitimate interest connected with preventing or detecting money laundering, terrorist financing or proliferation financing.

The legislation also states that information held on the central register must be “securely protected” and may be disclosed or used only following an application under the Act.

The Royal Gazette reported last Monday that journalists, researchers and others with a valid justification may apply for access under defined criteria. Media organisations may qualify where their work is connected with preventing financial crime, but applications require Registrar approval and disclosures are limited to the specified purposes.

Beneficial owners can also apply for an exemption from disclosure where it could place them in serious danger.

There is no suggestion that Bermuda’s register has been breached. But the Liechtenstein episode presents a challenge for jurisdictions wrestling with how to improve ownership transparency while protecting sensitive information.

The Gazette has asked the Registrar of Companies what cybersecurity and access-control safeguards protect Bermuda’s central register and whether the new legitimate-interest regime has prompted additional security reviews or testing.

It has also asked whether the Registrar is aware of any unauthorised access to, or compromise of, Bermuda’s register, and how it would respond if so.