MediumII Cyber Warfare & Critical Infrastructure19 October 2026, Monday
Cyberattack hits Austrian building automation maker Loxone's internal systems
Loxone's alarms went off around 03.00 on the night of 18 October, and the company disclosed a cyberattack on its internal systems on 19 October. The attackers claim to have copied roughly 200 GB of data.
The affected layer stayed on the corporate side. The company says the breach hit its internal customer relationship system — the CRM holding partner contact records — along with its job application system, and that most records belong to electrical installation firms. The website database was corrupted, and as of 19 October the site and the online shop are down. Loxone reports that the Miniserver controller inside buildings, the Remote Connect remote access service and Exosphere were untouched, and that installations are running without restriction.
A group calling itself "Samurai" says it copied roughly 200 GB of data. The published sample was reported to contain Microsoft 365 account details, single sign-on credentials and a list matching 300,000 Miniserver serial numbers to project names. Loxone has not confirmed those details. The company says it does not hold customer login credentials on its own servers, keeping them only on the Miniserver, and that payment data, source code and sensitive product information were not taken. It has not said whether a ransom was demanded or how the intruders got in, only that the route has been closed.
The structural constraint is this: even where the control layer in building automation stays local, the manufacturer's corporate IT carries the inventory of installations. If the match between 300,000 serial numbers and project names is confirmed, that list becomes a ready map for attacks aimed at individual buildings. The hijacking of refrigeration controllers at roughly 700 supermarkets in France on 11 October showed three weeks ago how brittle the same layer is.
Talay assessment
Bottom line
The attack did not stop any buildings; it took the manufacturer's customer and installation records. The real risk is not the outage but a 300,000-record inventory turning into a target list for a second wave. The most likely direction is part of the copied data appearing on a leak site, with phishing attempts against Loxone's partner network rising. Because the entry route was not disclosed, the risk of a repeat cannot be measured.
Likely effects
- Loxone partner networkNegativeWeeks
If contact details of the electrical installation firms held in the CRM leak, phishing messages impersonating installers could be used to request access to customer sites.
- Building automation supply chainNegative1–6 months
One corporate system on the manufacturer's side aggregates the inventory of thousands of installations, which cheapens target selection and shifts the audit burden onto the customer.
- European regulatory pressureUncertain1–6 months
Coming on top of the 11 October refrigeration attack on 700 supermarkets, this incident strengthens calls for binding security requirements on building and plant controllers.
Possibilities, ranked
- 1Data published on a leak site55%
Negotiation fails, the group releases more than the sample and the scope of the inventory becomes verifiable from outside.
Watch: Part of the claimed 200 GB being published by early November
- 2Incident confined to the corporate layer30%
No spread to customer sites appears, Loxone restores systems in stages and the website works again.
Watch: No confirmed incident on the Miniserver side reported by the middle of November
- 3Second wave aimed at installations15%
The serial number list is used to attempt access to individual buildings under an installer's identity.
Watch: A newly reported access attempt at buildings with Loxone installations in Austria or Germany
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Data claimed copied▼ roughly 200 GB
- Serial numbers in the sample▼ 300,000
- Website and online shop▼ down