The Loxone cyberattack affected parts of the building automation company’s internal IT systems on 18 October 2026. Loxone says customer installations remain operational and its principal automation services have not been affected.
The Austrian vendor disclosed the incident publicly on 19 October 2026 after isolating affected systems, appointing external cybersecurity specialists and notifying the relevant authorities. A forensic investigation remains under way, with the method of entry and the full extent of the compromise still unknown.
Loxone cyberattack: What happened
Loxone detected unauthorised access to parts of its internal company systems on Sunday 18 October 2026. According to the vendor, it responded immediately by separating affected systems from the rest of its environment and beginning an investigation with external specialists.
The company has characterised the event as a cyberattack, but it has not identified which areas of corporate IT were accessed. It has also not explained how the attacker entered the environment, how long access may have persisted, or whether the attacker moved between systems before detection.
Loxone notified the relevant authorities as part of its response. It also said that it would contact affected individuals if the investigation established that notification was legally required, although it had not confirmed that personal or commercially sensitive data was accessed.
Public disclosure and temporary website disruption
Loxone published its incident notice and press release on 19 October 2026. The notice said that customer installations were continuing to operate normally and that compromised internal systems had been isolated while forensic work continued.
Austrian media reported that employees had been informed and that Loxone’s website was temporarily offline on 19 October. The website was subsequently reachable and displayed an important information banner about the incident, suggesting a brief disruption rather than continuing unavailability.
The banner reiterated that Miniserver, Remote Connect and Exosphere were not affected. No later official update about the root cause, internal scope or possible loss of data had been published at the time of writing.
Products unaffected by the Loxone cyberattack
The confirmed impact concerns Loxone’s internal corporate IT, not a disclosed vulnerability in a building automation product. No affected product versions have been named, and there is currently no indication that customers need to install an emergency firmware or software update in response to this incident.
Loxone specifically identified three parts of its automation environment as unaffected:
-
Miniserver building controllers, which operate locally at customer premises.
-
Remote Connect, the service used to provide remote access to installations.
-
Exosphere, Loxone’s service for monitoring and managing building automation environments.
The vendor says customer installations continue to function normally. This distinction is important because compromise of a technology supplier’s corporate network does not automatically mean that deployed products or customer environments have also been breached.
Why local Miniserver operation matters
Loxone has highlighted the architecture of its Miniserver systems when explaining why customer automation remains operational. A Miniserver is designed to run building functions locally, using local credentials rather than depending on a central cloud system for normal operation.
This architecture reduces the operational connection between Loxone’s internal business systems and automation running inside customer properties. Consequently, an incident affecting corporate IT does not necessarily interrupt lighting, heating, access control or other locally managed building functions.
However, this does not establish that every system connected to Loxone is free from risk. It reflects the vendor’s current assessment of the Loxone cyberattack, and organisations should continue to monitor official updates while the forensic investigation remains open.
Ransomware and data theft claims remain unverified
Some online reports have described the incident as ransomware and claimed that approximately 201.6 GB of information was removed. Neither claim had been confirmed by Loxone as of 19 October 2026.
The company has not said that files were encrypted, that a ransom demand was received or that information was exfiltrated. No named ransomware group has been credibly linked to the Loxone cyberattack, and no reliable victim listing or threat actor statement has been identified.
The 201.6 GB figure should therefore be treated as unverified. Confirmation of data theft, publication of stolen material or attribution to an extortion operator would materially change the assessment, but the available evidence currently supports only a confirmed intrusion into parts of internal corporate IT.
No technical indicators or attack method disclosed
Loxone has not released indicators of compromise that defenders could use to search their own environments. There are no published malicious IP addresses, domains, file hashes, filenames or email indicators associated with the incident.
The initial access route is also unknown. There is no confirmed evidence that the attacker exploited a product vulnerability, used stolen credentials, delivered phishing emails or compromised a third party. Details about persistence, privilege escalation and lateral movement inside Loxone’s network have likewise not been disclosed.
As a result, there is no public proof of concept or attack tool for customers to assess. The Loxone cyberattack is a targeted incident investigation rather than a disclosed vulnerability with known affected versions and remediation instructions.
Confirmed timeline and current investigation status
-
18 October 2026: Loxone detected unauthorised access to parts of its internal IT. It isolated affected systems, started forensic analysis with external specialists and notified the relevant authorities.
-
19 October 2026: The company publicly disclosed the incident through its website and a press release. Media coverage appeared on the same day, including reporting of a temporary website outage.
-
19 October 2026: Loxone’s website displayed an incident banner stating that Miniserver, Remote Connect and Exosphere were unaffected. The investigation remained in progress.
There is currently no public attribution and no confirmed exploitation of customer installations. The most important outstanding questions concern which corporate systems were accessed, whether information was viewed or removed, and how the attacker initially gained entry.
What UK customers and partners should do
UK organisations using Loxone systems do not currently have a vendor instruction to disconnect Miniservers or disable Remote Connect or Exosphere. They should nevertheless review new incident notices and record whether any support, account or administrative activity appears unusual.
Customers and installation partners should be cautious about emails or calls that reference the Loxone cyberattack, particularly messages requesting credentials, payments or urgent account changes. Requests should be checked through a known Loxone contact route rather than links or telephone numbers supplied in an unexpected message.
Partners should also allow for possible delays in support or administrative services while internal systems are investigated. If Loxone later confirms exposure of personal data, credentials or partner information, organisations can then take targeted action based on the affected data and the vendor’s instructions.
Originally reported by borncity.com.
