Breaches

Loxone says hackers took customer data in attack on its IT

Loxone confirms a cyber attack on its internal IT and says customer data was taken. Miniservers are unaffected, but UK installers face phishing risk.

Illustration of a server with a data breach warning for the Loxone cyber attack

Austrian building automation maker Loxone has confirmed a cyber attack on its internal IT, and a senior executive now says customer data was taken. The Miniserver controllers in homes and buildings are said to be unaffected, but UK installers and their clients should prepare for follow-on phishing and questions about their data.

What happened

Loxone, the smart home and building automation company based in Kollerschlag, Upper Austria, spotted an intruder inside parts of its corporate IT on Sunday 18 October 2026. The firm, founded in 2009 with more than 1,300 staff, replaced the front page of loxone.com with an incident statement in several languages.

That statement, and a press release issued on Monday 19 October, set out four points. The attack hit internal company systems. The affected systems were isolated straight away and forensic analysis began with outside security specialists. The relevant authorities have been informed. Miniserver, Remote Connect, Exosphere and other services are not affected, so customer installations keep running. People whose data is shown to be affected will be contacted directly, it says.

The bigger news also came on Monday. Speaking to the Austrian public broadcaster ORF, Florian Wöss of Loxone’s management said that customer data had also been exfiltrated. He told ORF that the attackers got in through one of the company’s web servers, that all systems were shut down and are now being restarted step by step, and that a hacking group calling itself “Samurai” is behind the intrusion. The trade title buildingTIMES carried the same account. Loxone says it cannot yet put a figure on the damage.

The technical picture

Very little technical detail has been published. Loxone has not released indicators of compromise, said which internal systems were reached, or said how long the attackers were inside before being spotted. The only indication of the point of entry is Wöss’s comment that the attack came through a web server, which suggests an internet-facing application or host rather than, say, a phished employee laptop.

There are also unverified claims of extortion. Günter Born’s IT blog reported that a reader saw a ransom message briefly posted on the Loxone website. The note reportedly claimed 201.6 GB had been copied and encrypted from the internal network and threatened publication when a countdown ended. Loxone has not confirmed encryption, a ransom demand or the size of any theft, and the UK consultancy CyPro said on 19 October that both the ransomware label and the data volume remained unverified. Readers should treat those figures as claims, not facts.

The architectural point Loxone keeps returning to does matter. A Miniserver runs the building’s lighting, heating, blinds and access logic locally, with its own user accounts, and does not need Loxone’s servers or the internet to work. It does not, however, cover the data Loxone holds about those installations, its partners and its customers, and that is exactly what Wöss has now said was taken.

Timeline of the Loxone cyber attack from detection on 18 October to confirmation that customer data was taken

Why it matters for UK organisations

Loxone sells through a network of trained installer partners, and UK consultancy CyPro has already issued guidance aimed at UK customers and partners. Its kit sits in private homes, offices, schools, hotels and commercial buildings. Its corporate systems are where partner accounts, customer records, support tickets and project details are likely to live. If any of that is in the stolen data, UK installers and building owners become targets, even though their controllers are untouched.

The obvious risk is convincing phishing. A criminal holding real project names, addresses and contact details can write a very believable email asking a partner to “re-validate” an account, download an “urgent firmware fix” or update bank details for an invoice. With building automation, leaked remote access details or door control configuration could help plan more than a data theft.

There is a data protection angle as well. UK firms that shared customer personal data with Loxone, for example through a partner portal or support case, should work out whether Loxone was acting as their processor or as a separate controller. If it was their processor and personal data relating to their clients was compromised, they may have their own UK GDPR breach assessment to make once Loxone gives them the facts, and the 72-hour clock to the ICO runs from when they become aware.

Expert view

Loxone has made a fair point about its architecture. When we test building management systems, the worrying cases are those where a single vendor cloud sits between the owner and every controller. Local-first design genuinely limits the blast radius when the vendor is breached.

But the messaging has run ahead of the facts. Leading with the message that installations are unaffected, then having an executive confirm within a day that customer data has gone, is the pattern that erodes trust after an incident. “Installations are unaffected” and “customers are unaffected” are not the same statement, and the second one was never safe to imply while forensics was in its first day.

The entry point also deserves attention. In my experience, vendor web estates grow sideways over the years: old portals, download servers, documentation sites and test instances that sit outside the main patching and monitoring routine. A compromise that starts on a web server and reaches customer data points to too little segmentation between public-facing hosts and back-office systems.

What to do now

  1. Warn your people and your clients about Loxone-themed phishing. Treat any unexpected message about account resets, firmware, payments or changed bank details with suspicion, and check through a known Loxone contact or by typing the address yourself. This fits the Cyber Essentials expectation of user awareness and secure configuration of email.
  2. Reset and harden Loxone account credentials. Use a unique, strong password for partner and customer accounts, and turn on multi-factor authentication wherever it is offered on vendor portals and the email accounts linked to them (Cyber Essentials user access control).
  3. Review remote access to Miniservers. Remove unused users and shared accounts, rotate passwords that may have appeared in support tickets or project documents, and avoid exposing controllers directly to the internet; put them behind a VPN instead (Cyber Essentials firewalls and secure configuration).
  4. Only take firmware and software from official sources. Do not install anything sent as an attachment or link, however plausible it looks (Cyber Essentials malware protection and security update management).
  5. Map what data you have shared with Loxone. Identify any personal data in partner portals, tickets or project files, confirm the contractual relationship, and be ready to run a UK GDPR breach assessment when Loxone confirms scope.
  6. Follow official updates and record your decisions in case the ICO or a client asks later.

Bottom line

The building controls themselves appear safe, thanks to a design that keeps Miniservers independent of Loxone’s own systems. The company’s data does not, and a senior executive has confirmed customer data was taken by a group calling itself Samurai. UK installers and building owners should assume they could be targeted with well-informed phishing, tighten access to vendor accounts and controllers now, and press Loxone for a clear statement of what was stolen.

Sources

Related Posts