Based on the initial suspicion, the Office of Information Technology immediately implemented measures to secure the data and took the affected system offline. At the same time, a comprehensive analysis of the incident was initiated. On 31 July 2026, the Government was informed that a potentially successful attack on the VwbP had taken place. On the afternoon of 1 August 2026, the first confirmed results of the preliminary investigations were transmitted to the Government.

Following the criminal attack on the Register of Beneficial Owners (VwbP), four state systems were taken offline as a precautionary measure in order to subject them to additional security checks. On 5 August, the crisis unit decided to review further systems and to take them offline temporarily for this purpose.

Starting Monday, 5 October 2026, operation of the VwbP resumed in a limited form after the identified vulnerabilities had been remedied. Until further notice, access is possible only after personal identification of the user concerned and with a reduced range of technical functions. The security checks on the systems taken offline have also been completed, and those systems have been brought back into operation. For access to certain applications, login by eID is now required. Data integrity has meanwhile also been confirmed. Comparison with the data backups shows that the VwbP's data was not modified by the cyberattack.

Following completion of the security analyses, the Government has decided, as a further step, to bring in an international firm with the relevant specialist expertise for an additional external IT audit. The Government will provide information on the results once the report is available, taking into account the protection of security-relevant information.

The National Cyber Security Unit is in contact with the operators of critical infrastructures in order to assess the situation on an ongoing basis. The National Cyber Security Unit's inquiries to date give no indication that critical infrastructures are affected. Meanwhile, the prosecution authorities' investigations to find the perpetrators are proceeding urgently. To date, there are no indications that the stolen data has been published.