Smart-home and building-automation company Loxone has confirmed a cyberattack on its internal systems, in which data from its customer-relationship system and its applicant records were copied. The company detected the attack on Sunday 18 October 2026 and says the affected systems were isolated, with the attack path identified together with external forensic experts.

What was taken

According to Loxone's incident page, the copied data may include contact details of business partners — mainly electrical installation companies — along with support requests and data submitted by job applicants. Loxone says the full scope is still under review and that affected individuals will be notified as required by law. A later update adds that databases the attackers had encrypted were decrypted for analysis, and the company has not described the attack path publicly for security reasons.

The ransom claim

The incident became public when several pages on loxone.com were replaced with a ransom message. Reporting on the incident cites a group calling itself “Samurai”, claiming about 200 gigabytes had been copied and encrypted and threatening publication unless Loxone negotiated. Loxone itself has not confirmed any volume of data, and no source has named a specific vulnerability or misconfiguration behind the breach. Reports citing an interview with Loxone president Florian Wöss say the attack came through one of the company's web servers, but Loxone's own written statement does not repeat that claim.

What partners should do

For installers and partners, the practical lesson is the same as in any supplier breach: watch for phishing that uses real partner or applicant details, rotate any shared credentials, and treat unexpected messages claiming to come from Loxone with extra care until the company confirms the scope. Loxone says it will continue to update its incident page as the forensic review progresses.