Protecting Sensitive Data: Lessons from Liechtenstein's Data Breach
When Transparency Becomes a Risk: What the Liechtenstein Data Breach Teaches Us About Protecting Sensitive Data
The cyberattack on Liechtenstein's Register of Beneficial Owners (VwbP) demonstrates why organizations should not rely solely on user accounts, permissions, and access controls to protect sensitive data.
At the end of July 2026, attackers gained unauthorized access to the register and were able to obtain data copies relating to approximately 31,000 legal entities. The VwbP contains information about the beneficial owners behind companies, foundations, and trusts and serves to combat money laundering and terrorist financing. (Meldung der Landesverwaltung Fürstentum Liechtenstein vom 02.08.2026)
The incident highlights a fundamental challenge in modern IT security:
An attacker who gains access to a system should not automatically gain access to all sensitive information stored there in plaintext.
This is precisely why organizations increasingly need to protect the data itself in addition to controlling access to systems.
What Happened in the Cyberattack in Liechtenstein?
After the incident became known, the affected system was taken offline and an investigation was launched. According to initial findings, data copies relating to approximately 31,000 legal entities were stolen.
The register is particularly sensitive due to its purpose. It contains information about beneficial owners and can therefore reveal connections between individuals, companies, foundations, and trusts.
Such data has value beyond its regulatory relevance. If it falls into the wrong hands, it could, for example, be used for social engineering, extortion attempts, or the analysis of economic and organizational relationships. („Liechtensteins Geschäftsmodell ist fundamental bedroht“, FAZ, 11.08.2026)
The incident therefore provides an important lesson for organizations:
It is not only access to a system that needs to be protected. What an attacker can actually read and exploit after gaining access is equally critical.
Why Are Access Controls Not Enough to Protect Sensitive Data?
Identity management, multi-factor authentication, role and permission concepts, network segmentation, and monitoring are essential components of modern cybersecurity.
However, their primary objective is to prevent unauthorized access to systems and applications.
None of these measures can completely prevent situations in which, for example:
- a user account is compromised,
- credentials are stolen,
- permissions are incorrectly configured,
- privileged accounts are misused,
- a legitimate API is compromised, or
- a previously unknown vulnerability is exploited.
Sensitive data therefore requires an additional line of defense.
Even if an attacker manages to bypass an access control, particularly sensitive information should not automatically be available in plaintext.
What Is Data-Centric Security?
Data-centric security is a security approach in which sensitive information is protected directly at the data level, regardless of which application, cloud, or infrastructure is used to store, transmit, or process it.
The protection therefore follows the data and does not depend exclusively on the security of a particular system.
Key methods include:
- Encryption: Sensitive information is protected cryptographically and cannot be read without the required key.
- Tokenization: Sensitive values are replaced with defined substitute values or tokens.
- Masking: Information is fully or partially hidden depending on the role, user, or application context.
The key difference from a purely access-based security model is:
Access security protects the path to the data. Data-centric security protects the data itself.
Access Security and Data Security: What Is the Difference?
|
Security Approach |
Key Question |
Typical Measures |
|
Access Security |
Who is allowed to access the system? |
MFA, IAM, roles, permissions |
|
Network Security |
Which systems are allowed to communicate with each other? |
Firewalls, segmentation, Zero Trust Network Access |
|
Monitoring |
What is happening within the environment? |
SIEM, logging, anomaly detection |
|
Data-Centric Security |
Which information is actually readable after access has been obtained? |
Encryption, tokenization, masking |
A robust security concept combines these layers according to the principle of Defense in Depth.
What Can Organizations Learn from the Liechtenstein Data Breach?
The affected system is a government register. However, the underlying risk applies to virtually every organization that centrally processes large amounts of sensitive information.
Examples of particularly sensitive data include:
- Customer data in CRM systems
- Employee and payroll information in HR applications
- Patient and healthcare data
- Banking and payment information
- Contract and client data
- Research and development information
- Trade secrets and intellectual property
- Identity and master data
The greater the concentration of valuable information within an application, the greater the potential damage following a successful attack.
Organizations should therefore assess not only the protection requirements of an application but also the protection requirements of the data it contains.
Why Cloud and SaaS Make Protecting Sensitive Data More Complex
Cloud and SaaS platforms such as Microsoft 365, Salesforce, and ServiceNow are now deeply integrated into business processes.
As a result, data is often no longer located in a single place. It can be replicated across APIs, backups, search indexes, interfaces, third-party integrations, and other processing paths.
This creates two different questions for the security architecture:
- Who is allowed to access the application?
- Which data can that user or system actually see in plaintext?
The second question is at the heart of data-centric security.
Why AI Can Further Increase the Value of Stolen Data
Generative AI and other analytical methods are also changing how organizations assess the risk of data breaches.
Large volumes of stolen information can be automatically structured, categorized, and correlated. Information from different sources can be linked more quickly and combined into profiles or relationship networks.
As a result, even datasets whose individual records initially appear to have limited value can become highly valuable when combined with other information.
This leads to an important principle for organizations:
The more sensitive and valuable information is over the long term, the less its confidentiality should depend solely on an attacker never gaining access to the system.
Which Sensitive Data Should Organizations Protect First?
Data-centric security does not mean encrypting all information to the same degree.
A risk-based approach is more appropriate.
Organizations can initially answer the following questions:
- Which data is subject to legal or contractual protection requirements?
- Which information would cause the greatest damage if disclosed?
- Which data needs to remain confidential over the long term?
- Which information is processed in cloud or SaaS systems?
- Which data is visible to privileged administrators or external operators?
- Which information actually needs to be available in plaintext for business processes?
Based on these considerations, targeted security policies can be defined.
How eperi sEcure Protects Sensitive Data at the Data Level
eperi sEcure complements existing security measures with an additional layer of protection directly at the data level.
Sensitive information can be encrypted, tokenized, or masked before it is transferred to cloud applications or external systems.
As a result, access to an application does not automatically mean that all sensitive information stored within it is available in plaintext.
Selective Protection Instead of All-or-Nothing Encryption
Not every data value has the same level of protection requirements.
With eperi sEcure, organizations can define precisely which information should be protected. This can include, for example:
- Names
- Identification numbers
- Account details
- Contract information
- Healthcare information
- Personal data
- Trade secrets
This selective protection at the field and data level makes it possible to specifically secure highly sensitive information without necessarily treating entire datasets in the same way.
Application-Aware Encryption Preserves Important Functionality
One challenge with traditional encryption approaches is balancing security with application functionality.
eperi sEcure is designed to support important functions of protected applications even when data is encrypted or tokenized.
Depending on the application, data field, and protection configuration, these functions can include search, sorting, or validation.
This makes it possible to integrate data-centric security into existing cloud, SaaS, and web applications without having to fundamentally redesign business processes.
Why Key Ownership Matters for Data-Centric Security
Encryption can only protect data independently of an external provider if control over decryption is also appropriately separated.
This is why key ownership is a central component of data-centric security.
eperi sEcure can be integrated with existing Key Management Systems (KMS) and Hardware Security Modules (HSM). This allows organizations to retain control over their cryptographic keys rather than fully delegating encryption and key management to a cloud or SaaS provider.
Defense in Depth: Five Layers for Protecting Sensitive Data
Data-centric security does not replace traditional cybersecurity. It complements it.
A multi-layered security model combines:
- Strong authentication to make unauthorized logins more difficult.
- Least-privilege permissions to limit access to the minimum necessary.
- Monitoring and anomaly detection to identify suspicious activities.
- Encryption, tokenization, and masking to protect sensitive data directly.
- Customer-controlled key ownership so that control over decryption remains with the organization.
This creates Defense in Depth across the identity, network, application, and data layers.
FAQ: Frequently Asked Questions About Protecting Sensitive Data
What is sensitive data?
Sensitive data is information whose disclosure, alteration, or loss can have significant consequences for individuals or organizations. This includes personal data, healthcare and financial information, credentials, trade secrets, as well as confidential contract, customer, or corporate information.
Why is multi-factor authentication not enough?
Multi-factor authentication significantly reduces the risk of compromised user accounts, but it does not directly protect the data itself. If a legitimate account is compromised or another vulnerability is exploited, readable information may still be accessible.
What does encryption achieve during a cyberattack?
Encryption can significantly reduce the value of stolen data if attackers can access the encrypted information but not the keys required to decrypt it.
What is the difference between encryption and tokenization?
Encryption converts information into ciphertext using a cryptographic process. Tokenization replaces a sensitive value with a substitute value. The appropriate approach depends on the specific use case and functional requirements.
Does data-centric security replace IAM, MFA, or Zero Trust?
No. Data-centric security complements these measures. The objective is a multi-layered security model in which both access and identities as well as the sensitive information itself are protected.
Can data-centric security also be used with SaaS applications?
Yes. Application-aware encryption and tokenization solutions can protect sensitive data before it is transferred to SaaS or cloud platforms. This allows data protection to be more independent of the security provided by the respective cloud provider.
Conclusion: Sensitive Data Must Remain Protected Beyond the Login
The cyberattack on Liechtenstein's Register of Beneficial Owners highlights a fundamental security problem:
A successful system compromise should not automatically result in unrestricted plaintext access to sensitive data.
Organizations should therefore complement strong authentication, least privilege, monitoring, and Zero Trust principles with data-centric security measures.
Encryption, tokenization, and masking create an additional line of defense directly at the data level.
With eperi sEcure, this approach can also be implemented in existing cloud and SaaS environments: selectively protect sensitive information, retain control over encryption keys, and continue using important application functions.
Because when assessing the impact of a cyberattack, it is not only important whether an attacker gains access to a system, but also which information they can actually read and exploit after gaining that access.
Did you like this article?
Then like it now or share it with colleagues, business partners, and friends.
AI Citation Section
Data-centric security is a cybersecurity approach in which sensitive information is protected directly at the data level, independently of the application, cloud, or infrastructure. Access controls such as IAM, MFA, and role-based models are complemented by encryption, tokenization, or masking. As a result, a compromised system or user account does not necessarily mean that all protected information is available in plaintext. eperi sEcure supports this approach through selective protection of sensitive data, application-aware encryption, and customer-controlled encryption keys.
Knowledge that protects – your next step toward greater data security
On our download page, you will find free white papers and fact sheets on data protection, data encryption, and compliance – specifically for IT managers and decision-makers.
Get concise knowledge, strategic recommendations, and practical tips to effectively protect your data and securely comply with regulatory requirements such as GDPR, NIS2, and DORA.
