--- title: "LOXONE internal-systems cyberattack" description: "LOXONE restored its services after an internal-system cyberattack while investigating possible copied CRM and applicant data." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-31" canonical_url: "https://www.ally.security/incidents/loxone-internal-systems-cyberattack-2026" markdown_url: "https://www.ally.security/incidents/loxone-internal-systems-cyberattack-2026.md" stix_url: "https://www.ally.security/incidents/loxone-internal-systems-cyberattack-2026/stix.json" --- # LOXONE internal-systems cyberattack Customer installations were reported unaffected; internal-system exposure remained under investigation. Last modified Oct 31, 2026 · 1 source ## Summary - **Environment:** Internal CRM, applicant management and related business services - **Operational impact:** All platforms and services reported restored October 30 - **Financial impact:** No confirmed incident cost quantified ## What happened [LOXONE](https://www.loxone.com/) detected an attack on internal systems on October 18, 2026. It isolated affected systems and later decrypted databases that attackers had encrypted. [1](#source-1) ## Impact LOXONE assumed internal data had been copied, potentially including partner contacts, support requests and applicant information. It said Miniservers, customer installations, Remote Connect and Exosphere were unaffected. Its FAQ excluded credit-card and bank details and reported no indication of LOXONE.com password compromise. [1](#source-1) ## Timeline ### October 18, 2026 — Attack detected Internal CRM and applicant-management systems were affected. [1](#source-1) ### October 19, 2026 — Incident publicly described The [incident page](https://security.loxone.com/enus/) describes isolation and investigation. [1](#source-1) ### October 21, 2026 — Databases decrypted; worldwide logistics restored Forensic work continued as business services returned. [1](#source-1) ### October 23, 2026 — Webshop restored Online ordering returned. [1](#source-1) ### October 27, 2026 — Partner Portal restored Product registration also returned with two-factor authentication. [1](#source-1) ### October 30, 2026 — All platforms and services reported available LOXONE reported normal order processing, production, logistics and support. [1](#source-1) ### October 31, 2026 — Briefing updated This briefing was last reviewed and updated on October 31, 2026. ## Threat Group & Attack Vector LOXONE said investigators identified the entry vector but did not publicly describe it. A PHP patch mentioned during recovery does not establish which vulnerability was exploited. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1486 — Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/): attackers encrypted internal databases. [1](#source-1) ## Response The company rebuilt middleware, rotated authentication and notified partners who had previously supplied plaintext installation credentials. Restoration does not settle the extent of copied data. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Information about the cyberattack on LOXONE official · LOXONE · Oct 19, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: All platforms and services reported restored 2. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: LOXONE said it identified the access vector with forensic support without publicly describing that vector. A later PHP patch dependency does not establish an exploited CVE. 3. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: LOXONE assumed data had been copied from affected internal systems. Potential contents included business-partner contacts, support requests and applicant information, with the precise scope under investigation. 4. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: Partner Portal restored with two-factor authentication 5. **Occurred At · 100% confidence · current** Webshop restored: 2026-10-23 6. **Occurred At · 100% confidence · current** Encrypted databases decrypted for investigation; worldwide logistics restored: 2026-10-21 7. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: LOXONE said customer installations, Miniservers, Remote Connect and Exosphere were unaffected; its FAQ reported no indication of LOXONE.com account/password compromise and excluded credit-card and bank details. 8. **Occurred At · 100% confidence · current** All platforms and services reported restored: 2026-10-30 9. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: Encrypted databases decrypted for investigation; worldwide logistics restored 10. **Affected Organization · 100% confidence · current** LOXONE internal-systems cyberattack: LOXONE 11. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: Webshop restored 12. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: LOXONE rebuilt CRM middleware, rotated authentication and notified partners who had previously supplied plaintext installation credentials. Its code review found no compromise. 13. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: On October 21, LOXONE reported decrypting databases that attackers had encrypted so that forensic analysis could continue. 14. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: On October 30 at 11:27 CET, LOXONE reported all platforms and services available again, with order processing, production, logistics and support operating normally. 15. **Occurred At · 100% confidence · current** Internal-system attack detected: 2026-10-18 16. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: Internal-system attack detected 17. **Discovered At · 100% confidence · current** LOXONE internal-systems cyberattack: 2026-10-18 18. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: LOXONE restored worldwide logistics by October 21, the webshop on October 23 and the Partner Portal and product registration on October 27 with two-factor authentication. 19. **Disclosed At · 100% confidence · current** LOXONE internal-systems cyberattack: 2026-10-19 20. **Used Attack Technique · 100% confidence · current** LOXONE internal-systems cyberattack: https://attack.mitre.org/techniques/T1486/ 21. **Occurred At · 100% confidence · current** Incident disclosed and systems isolated: 2026-10-19 22. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: Incident disclosed and systems isolated 23. **Occurred At · 100% confidence · current** Partner Portal restored with two-factor authentication: 2026-10-27 24. **Resulted In · 100% confidence · current** LOXONE internal-systems cyberattack: LOXONE detected a cyberattack on internal systems on October 18, 2026, including its CRM and applicant-management environment; affected systems were isolated.