Summary
- Environment: Internal CRM, applicant management and related business services
- Operational impact: All platforms and services reported restored October 30
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed October 31, 2026; updated as evidence emerges.
What happened
Impact
LOXONE assumed internal data had been copied, potentially including partner contacts, support requests and applicant information. It said Miniservers, customer installations, Remote Connect and Exosphere were unaffected. Its FAQ excluded credit-card and bank details and reported no indication of LOXONE.com password compromise. [1]
Timeline
Attack detected
Internal CRM and applicant-management systems were affected.
[1]Incident publicly described
The incident page describes isolation and investigation.
[1]Databases decrypted; worldwide logistics restored
Forensic work continued as business services returned.
[1]Webshop restored
Online ordering returned.
[1]Partner Portal restored
Product registration also returned with two-factor authentication.
[1]All platforms and services reported available
LOXONE reported normal order processing, production, logistics and support.
[1]Briefing updated
This briefing was last reviewed and updated on October 31, 2026.
Threat Group & Attack Vector
LOXONE said investigators identified the entry vector but did not publicly describe it. A PHP patch mentioned during recovery does not establish which vulnerability was exploited. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1486 — Data Encrypted for Impact: attackers encrypted internal databases. [1]
Response
The company rebuilt middleware, rotated authentication and notified partners who had previously supplied plaintext installation credentials. Restoration does not settle the extent of copied data. [1]