Summary
- LOXONE detected an internal systems attack on 18 October and assumes some CRM and applicant information was copied.
- The company says Miniserver installations and separate remote services were not affected.
- LOXONE reported worldwide logistics restored by 21 October, but public web services were still awaiting final security updates.
Austrian building automation company LOXONE says it has resumed product deliveries after a cyberattack affected internal business systems, although investigators are still determining what information was taken. The company identified its customer relationship management and applicant management environments as the principal affected systems and said it assumes information was copied from them.
LOXONE detected the incident on 18 October and isolated affected infrastructure. Its public updates describe business disruption followed by a staged recovery, including the restoration of headquarters logistics and order processing on 20 October. By its 21 October update at 12:02 CEST, it said warehouse, picking and shipping processes had resumed at headquarters and logistics sites in the UK, US and Switzerland. A 25-person incident response team remained active.
The potential data exposure includes business partner contacts, support requests and applicant information, according to LOXONE’s frequently asked questions. It has not provided a count of affected individuals or a completed inventory of copied records. The company says those demonstrably affected will receive direct notifications under applicable legal requirements. It also says payment and banking details were not affected.
A central distinction in LOXONE’s account concerns its products in buildings. The company says Miniserver devices operate locally, keep user credentials on the device and do not depend on its affected corporate infrastructure for routine building control. It also identifies Remote Connect and Exosphere as separate and unaffected services. Those statements are based on the company’s own investigation and do not, by themselves, establish every possible risk across every installed product.
Business systems and operational control are separated
Building automation products can manage lighting, climate, access and other site functions, making the relationship between a manufacturer’s enterprise IT and deployed customer equipment a material issue after a breach. LOXONE’s architecture, as described by the company, separates the local control function from corporate CRM and applicant databases. That is why an intrusion into the manufacturer’s administrative environment need not imply loss of control in a customer building.
The company’s service restoration nevertheless required security checks. In its 21 October update, LOXONE said its website, webshop and Partner Portal were technically restored and had passed internal and external penetration tests, but it was withholding public access while installing PHP security fixes. Technical restoration therefore did not yet mean that every online service had reopened. The same update states that its codebase had been reviewed and that investigators found no compromise of that codebase.
LOXONE also reported that it was able to decrypt databases encrypted during the attack to examine their contents. This identifies an encryption component of the incident, but the company has not publicly attributed the attack to a named ransomware group or established the scope of any data extraction. A claim about extortion demands, a confirmed leak or a wider compromise of customer equipment would therefore be unsupported.
The affected business functions explain why partner communications and order channels were disrupted even as installed building systems continued operating. The company temporarily directed orders and support requests through email while restoration work progressed. The company said employees had largely resumed normal operations, although remaining public web services were still awaiting the last security and reopening steps.
The difference between encrypted and copied information also matters. Recovering access to an encrypted database, as LOXONE says it has done, does not establish whether an attacker obtained a separate copy before encryption. Nor does a statement that online credentials are hosted on different infrastructure determine the content of the affected CRM. The company has therefore limited its reassurance to specified services and data categories while continuing to investigate partner and applicant records. That measured separation is relevant to how subsequent notifications should be interpreted.
LOXONE says it has identified the attack vector with external forensic specialists but is not publicly describing it for security reasons. As of its latest located statement dated 21 October, LOXONE had not disclosed the attack method or established a final total of affected people. It continued reviewing internal records while maintaining that customer building installations had not been compromised.
