Visualização normal

Antes de ontemStream principal

Firewall Daily – The Cyber Express
Liechtenstein Cyberattack Exposes Data From Beneficial Ownership Register Ashish Khaitan
The Liechtenstein cyberattack has prompted authorities to investigate a major security breach after copies of sensitive data linked to around 31,000 legal entities were unlawfully accessed from the country's Register of Beneficial Owners (VwbP). Following the cyberattack on Liechtenstein, officials temporarily suspended external access to the register while investigations continue. Although data was exfiltrated, the government said there is currently no evidence that records were altered or
4 de Agosto de 2026, 07:07

Liechtenstein Cyberattack Exposes Data From Beneficial Ownership Register

4 de Agosto de 2026, 07:07

VwbP

The Liechtenstein cyberattack has prompted authorities to investigate a major security breach after copies of sensitive data linked to around 31,000 legal entities were unlawfully accessed from the country's Register of Beneficial Owners (VwbP). Following the cyberattack on Liechtenstein, officials temporarily suspended external access to the register while investigations continue. Although data was exfiltrated, the government said there is currently no evidence that records were altered or deleted.

Cyberattack on Liechtenstein's VwbP Register

According to the Liechtenstein government, the VwbP was targeted during the night of 29/30 July 2026, when unknown attackers gained unauthorized digital access to the system. Irregularities were detected by the Office of Justice on 30 July, prompting the Office of Information Technology to investigate, secure the affected systems, and immediately take the register offline. In a statement, the government said, "Copies of data relating to around 31,000 legal entities were unlawfully exfiltrated." It added that the register would remain unavailable to external users through the llv.li website until further notice. "According to the current state of knowledge, there are no indications that data in the system was modified or deleted," the statement noted.

Liechtenstein Cyberattack Triggers Government Response

The cyberattack on Liechtenstein has highlighted the growing cybersecurity risks facing international financial centres that manage assets for wealthy individuals, businesses, trusts, and other institutions. The VwbP is maintained to support anti-money laundering and counter-terrorist financing efforts by recording the beneficial owners of companies, foundations, trusts, and other legal entities. Authorities began reviewing the incident immediately after the suspicious activity was detected. On 31 July, the government was informed that the attack on the VwbP had likely succeeded. Preliminary investigation results were delivered on the afternoon of 1 August 2026, leading the government to establish a crisis unit that same Saturday evening. The unit, formally confirmed the following day, is headed by Prime Minister Brigitte Haas and Minister of Justice Emanuel Schädler. The Register of Beneficial Owners Act (VwbPG) came into force in 2021, implementing the requirements of the 5th EU Anti-Money Laundering Directive. The government also confirmed that the Liechtenstein cyberattack constitutes a personal data breach under the General Data Protection Regulation (GDPR).

VwbP Breach Raises Concerns Over Digital Trust

Commenting on the broader implications of the breach, Steve Lamb, CEO of Kyckr, said registries are becoming critical to Europe's evolving digital trust framework. "Under the digital trust model taking shape in Europe, the registry stops being a noticeboard we query and becomes the authentic source, a body that can sign a statement about who owns and controls a company, which thousands of institutions then rely on," he said. Lamb added that as registries become trusted sources for verifying ownership, their security becomes fundamental to the wider financial ecosystem. "The debate can't only be about standards, schemas and interoperability. Registries are becoming critical financial infrastructure, and they should be resourced like it." The digital trust model he referred to is the European Business Wallet, eIDAS 2.0. As investigations into the VwbP breach continue, officials are working to determine the full impact of the Liechtenstein cyberattack.

@BushidoToken Threat Intel
UK Cybercrime Journal: Arup Group Breached by FulcrumSec BushidoToken
What Happened:On 10 May 2026, the UK-based firm Arup Group was listed as a victim on the Tor data leak site of FulcrumSec. On their Tor data leak site, FulcrumSec stated that they have exposed 700GB of GitHub repos and 2TB of Azure and AWS S3 cloud, plus database backups.Other types of data the adversary claims to have stolen includes Neuron BMS client databases, Odoo ERP data, A66 landowner files, Apple code-signing certificates with plaintext passwords, a Google Cloud Platform (GCP) project w
10 de Junho de 2026, 04:00

UK Cybercrime Journal: Arup Group Breached by FulcrumSec

@BushidoToken Threat Intel

Por:BushidoToken

10 de Junho de 2026, 04:00

What Happened:

On 10 May 2026, the UK-based firm Arup Group was listed as a victim on the Tor data leak site of FulcrumSec.
On their Tor data leak site, FulcrumSec stated that they have exposed 700GB of GitHub repos and 2TB of Azure and AWS S3 cloud, plus database backups.
Other types of data the adversary claims to have stolen includes Neuron BMS client databases, Odoo ERP data, A66 landowner files, Apple code-signing certificates with plaintext passwords, a Google Cloud Platform (GCP) project with production payment gateway credentials, and the source code of ArupCompute and Oasys.
The FulcrumSec operators also claimed to have spent over half a year analysing the data and went through “email correspondence” with the company before publishing the stolen data.
On the victim post, FulcrumSec wrote a detailed incident breakdown. In it, they stated they gained initial access in September 2025 via a GitHub personal access token found hardcoded in a JavaScript file on a forgotten subdomain, which provided access to over 10,000 private GitHub repositories belonging to Arup Group.
From there, they scanned the repositories and found additional hardcoded tokens, API keys, and passwords for AWS, Azure, and databases.
The adversary stated that Arup detected the Github and Azure Storage intrusions approximately six weeks after they happened and rotated the credentials, but it was too late as the data had been exfiltrated.
FulcrumSec also stated they pivoted into the AWS infrastructure using keys they had found belonging to Arup’s subsidiary Neuron.
FulcrumSec allegedly waited until April 2026 to contact their victim, Arup Group, due to the time it took to analyse the vast amounts of stolen data.
Impacted client organisations of Arup Group were also mentioned in the post, such as Disney and several other Hong Kong companies. The adversary reportedly uncovered Amazon data center seismic fragility data, British Petroleum (BP) site selection coordinates, and Queensferry Crossing internal documents as well.
Critically for the UK, the breached data exposed up to 62 HS2 related GitHub repositories. This involved Euston Station pile design files, ground movement assessments, over 14,000 sensor monitoring records, 48 archaeological site GPS coordinates (including Jones Hill Wood, a sensitive site for environmentalists), as well as confidential documents.

Analyst Comment:

Arup Group is a large multinational architectural design and engineering firm based in London who has been involved in constructing the Wembley Football Stadium in London, the HS1 Channel Tunnel Rail Link network, and the Eden Project in Cornwall, among other significant international construction projects.

Active since September 2025, FulcrumSec is a financially motivated data-theft-extortion group that specialises in rapid exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions.

This attack was noteworthy due to its highly targeted nature. FulcrumSec claimed they had access to Arup Group’s data for seven months and they clearly invested significant time to analyse the documents and spent weeks negotiating over email. Plus, to find initial access they also would have had to spend time checking Arup’s domains and Internet-facing assets to eventually find a single leaked credential to exploit. These types of targeted intrusions often only happen to large companies. This is because for it to be worth the cybercriminal’s time, effort, and risk to their freedom they will want a large ransom payment that only rich companies can typically afford.

FulcrumSec is an adversary worth monitoring due to the effort they put into their intrusions compared to other smash-and-grab ransomware campaigns. In October 2025, in a case documented by VX-Underground, FulcrumSec emailed detailed information about the breach they conducted with the aim of those details getting published and exert additional pressure on the victim.

Interestingly, FulcrumSec said the ransom they demanded was less than 1% of Arup’s annual revenue and was less than how much Arup lost to the deepfake fraudsters. This is a reference to Arup reportedly lost over £20 million pounds in 2024 after one of their Hong Kong employees was duped into sending cash to cybercriminals using an AI-generated video call. The fact Arup became publicly known for falling victim to a large scam potentially contributed to the adversary’s decision to select and focus them for this attack.

Defensive Takeaways:

Asset Inventory and Shadow IT Audits: Identifying the outdated unused domains with hardcoded credentials is standard best practices. All organisations must have processes in place to catalog and retire systems to avoid incidents like this.
Hardcoded Credentials in Code: They way FulcrumSec gained access demonstrates the importance of using secret environment variables and features like GitHub Secret Scanning.
Implement Incident Response Procedures: Importantly, Arup detect the activity too late and it took them a staggering six weeks to rotate credentials (according to the adversary), which shows why having automated systems to check for unauthorised usage and reset tokens and all accounts is crucial to respond to such attacks.
GitHub Activity Monitoring: The adversary claimed they were able to clone thousands of GitHub repositories containing sensitive data without being detected. These types of activities are available to monitor and detect in GitHub Audit Logs. It’s also important to have a plan in place when suspicious activities are detected.
Third-Party Risk Management Programs: This incident also had some notable downstream impact. It shows why client organisations of another company’s services need to know what data and how much data is stored by third-parties for when such breaches occur. Knowing what’s potentially exposed will streamline the response to the incident.
Deception Tech: Arup could have implemented a boobytraps for the adversary such as the use of CanaryTokens inside sensitive documents. As the adversary spent time analysing the Arup’s documents before contacting them, if they open a boobytrapped document, then the incident could been detected much earlier and the damages could have been reduced.

Relevant Sources:

Relevant CTI Resources: