CADChain Blog

Loxone Cyberattack: What the Building Automation Maker's Breach Teaches Hardware Companies About Partner Portals, Support Tickets and Engineering Data | CADChain | CAD DRM & IP

On Sunday, 18 October 2026, the Austrian building automation maker Loxone detected an attack on its internal IT systems. A group calling itself Samurai defaced the company's website and claims to have copied about 200 GB of data. Loxone says data was copied from its CRM with partner contacts, from support requests and from its applicant system, while the Miniserver controllers that run customers' buildings were not affected.
Loxone, founded in 2009 and based in Kollerschlag, Upper Austria, employs more than 1,300 people and sells its Miniserver home and building automation system through a network of partner companies, mostly electrical installers. A member of its management told the Austrian broadcaster ORF that the attack came in through one of the company's web servers. Loxone shut its systems down, brought in external forensic specialists, informed the authorities and restarted services step by step over the following week.
For hardware and deep-tech companies, this is a useful case to study because the product itself was not the target. The data that leaked sat in the business systems around it: the CRM, the ticket system, the partner portal and the HR tools. Those systems often hold more engineering detail than anyone plans for. Here is what is known, what is only claimed, and what engineering teams should check at home.
TL;DR: Loxone cyberattack, detected 18 October 2026

Attackers entered through a web server and copied data from Loxone's internal systems. Loxone says the affected data includes partner contact details from its CRM, support requests and applicant data, and that the Miniserver, Remote Connect and Exosphere were not affected. The attackers claim 201.6 GB; Loxone has not confirmed a volume or a ransom demand. By 23 October, Loxone had rotated all authentication, rebuilt its CRM middleware, completed a supplier security audit, started testing two-factor authentication and brought its web platforms almost fully back online. The lesson for other manufacturers: map where technical data and credentials sit outside your engineering systems, because that is often where attackers find them.

What happened at Loxone?

Loxone's systems raised the alarm on 18 October. According to heise online's report of 19 October, attackers gained access to internal servers and copied data, and the group behind it changed the homepage of Loxone's website over the weekend to display its message. The ransom note, briefly visible on the site, claimed that 201.6 GB had been copied and encrypted from the internal network and threatened publication after a countdown.
Loxone has not said how much data was taken, whether a ransom was demanded or exactly how the attackers got in. It has said that the entry point was identified and closed. Employees were informed on Monday, 19 October, while the website, webshop and partner portal stayed offline. Order processing and shipping restarted at headquarters on 20 October, followed by Loxone's sites in the United States, the United Kingdom and Switzerland.

What data was taken, and what does Loxone say is safe?

In its own words, quoted by heise: "The internal CRM system and our applicant management system are affected." In an update on 20 October, Loxone said it assumes data was copied from internal systems, including CRM data with business partner contacts, support requests and applicant data, and that the full scope was still being checked. It also said some of the data is outdated. People who are affected will be told directly.
On the product side, Loxone's message has been consistent. The Miniserver, Remote Connect and Exosphere are not affected, and installations keep running. The company says it does not keep a central database of login credentials for customer installations: "User and access data are stored exclusively locally on the Miniserver, not with Loxone." According to heise, Loxone also said no payment card data, source code or sensitive product information was obtained.
Some claims are still open. Screenshots of an apparent attacker data list, shared on a Loxone user forum and described by heise, mention Microsoft 365 account information, single sign-on login details and a register of Miniserver units with about 300,000 serial numbers and project names. The same list mentions Confluence data, and Loxone said it does not use Confluence and that the loxwiki is a community project it does not run. None of these items has been confirmed by Loxone.
ItemStatusWhat it means for others
Entry through a web serverStated by Loxone managementPublic web servers are a way into internal data, not just a shop window
CRM with partner contactsConfirmed by Loxone as affectedPartner lists are perfect material for targeted phishing
Support requestsConfirmed by Loxone as affectedTickets often hold configs, drawings and passwords sent in plain text
Applicant dataConfirmed by Loxone as affectedPersonal data of candidates: a data protection matter
Miniserver, Remote Connect, ExosphereNot affected, says LoxoneKeeping customer credentials on the device limited the damage
Source code and product informationNot obtained, says LoxoneLoxone says its codebase was checked and is not compromised
201.6 GB copied and encryptedAttacker claim, not confirmedVolume claims in ransom notes are often inflated
M365, SSO details, 300,000 serial numbersAttacker sample list, not confirmedAsset registers link devices to projects and customers

Why do support tickets and partner portals matter so much?

Most engineering companies protect their PDM, PLM and source code repositories reasonably well. The CRM, the ticket system and the partner portal get less attention because they look like sales and service tools. In practice, they collect a lot of technical detail: configuration files, wiring plans, screenshots of settings, exported drawings, serial numbers linked to customer sites and, far too often, passwords that someone pasted into a ticket to get help faster.
Loxone itself appears to have seen this risk. According to a report by the electronics site Chiptron, which summarised Loxone's updates, the company reviewed its support history for installation credentials that had been sent in plain text, and users who ever shared a Miniserver password in an email or support ticket were advised to change it.
The same applies to applicant systems. Engineering candidates often send portfolios with drawings, models and project descriptions from previous employers. When an applicant system leaks, it can expose other companies' design data as well as personal data. Our guide to the ways employees accidentally leak CAD files covers how such files end up in the wrong places.

Why is phishing now the biggest risk?

A partner list with names, companies, email addresses and support history is ideal material for convincing fraud. Loxone's updates say that partners and anyone who received an email from the attackers will be informed, which indicates the attackers had already contacted people directly. Chiptron reported that one such email passed standard email authentication checks, which suggests the attackers could send messages through a legitimate Loxone mail service at that point.
Loxone has named two lookalike sender domains, loxon.com and luxone.com, and says it never asks for passwords by email, phone or text message and that its bank details have not changed. For partners and customers, that means any unexpected request for a password, a payment change or a file should be checked by calling a known number, not one taken from the message.
Partner data leaks. Design files should not. CADChain encrypts CAD files and controls who can open, edit, print or export each one, so a file attached to a ticket or shared with a partner stays under your control.

👉 See how CADChain works

What did Loxone do right, and what is still open?

Several of Loxone's choices limited the damage. Customer credentials live on the Miniserver, not in a central database, so the attack on corporate IT did not hand over access to customers' buildings. The company shut systems down quickly, published regular updates, and did not bring its website and partner portal back until internal and external penetration tests were done and fresh PHP security patches were installed. Those PHP patches answered critical PHP vulnerabilities that engineering teams had to patch to protect portals and CAD files, disclosed two days after the attack; no public source links them to the break-in.
By 22 October, Loxone said all authentication had been rotated, its CRM middleware had been rebuilt, a security audit of its suppliers was complete and two-factor authentication was in testing for Loxone Config, the partner portal and Exosphere. By 23 October, its web platforms were almost fully back online.
What remains open is the scope. Loxone has not published how many partners, customers or applicants are affected, and the attackers' claims about account details and the device register have neither been confirmed nor ruled out.

Do the Cyber Resilience Act and GDPR apply?

Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities in their products and severe incidents that affect the security of those products. Loxone says its products were not affected, and nothing published so far suggests otherwise. For other manufacturers, the line can be thin: if attackers reach signing keys, firmware build systems or device credentials, a corporate IT incident can become a product security incident. Our guide to Cyber Resilience Act reporting for CAD, software and hardware makers explains the deadlines.
Applicant and partner contact data are personal data. Under the GDPR, a personal data breach must generally be reported to the competent data protection authority within 72 hours of becoming aware of it, and affected people must be told when the risk to them is high. Loxone has said affected people will be notified as required by law. For engineering companies, our article on GDPR compliance for CAD DRM systems in Europe shows how access logs help answer the first question regulators ask: who could see what, and when.

What should hardware and deep-tech companies do now?

  1. Map your side systems. List every CRM, ticket system, partner portal, applicant tool and shared mailbox, and ask what technical files, configs and credentials end up in each one.
  2. Search tickets and mail for secrets. Look for passwords, API keys and device credentials pasted into tickets or emails. Rotate what you find and tell support staff never to ask for them.
  3. Keep customer access out of central databases. Loxone's design shows the value of storing device and site credentials locally or in a dedicated vault rather than in a CRM.
  4. Patch and test public web servers. Shops, portals and marketing sites are part of the attack surface. Keep PHP and frameworks current and separate them from internal networks.
  5. Use two-factor authentication everywhere. Partner portals, configuration tools and admin accounts need a second factor, and shared admin accounts should give way to personal ones.
  6. Prepare a partner warning. Write the message now: which channels you use, which domains are yours, and what you will never ask for. Send it within hours of an incident.
  7. Control the design files themselves. When drawings and models must go to partners or support, send protected files with per-file permissions instead of open attachments.
  8. Keep a dated record. Log what you did, when, and who could access which files. That record helps with GDPR and CRA questions, insurers and any later dispute.
For background, see our guides to how ransomware targets engineering firms, controlling CAD files beyond first-level partners, real-time CAD file access monitoring for supply chain partners, the difference between CAD file encryption and access control, how to audit CAD file access and tamper-proof CAD audit trails with blockchain. This month we also covered the Albert Heijn hack and the Ahold Delhaize cyber incident, the GitLab CVSS 10 flaw that put design repositories at risk, the Oracle Agile PLM vulnerabilities in the October 2026 patch update and the joint advisory on China-linked hackers for hire targeting manufacturing.

How does this fit the bigger picture?

Our sister sites covered other developments this week that touch the same question: who controls engineering data, and how you prove it.

Conclusion

The Loxone attack did not reach a single customer's building, according to the company, and that is largely down to a design choice made long before the incident: customer credentials stay on the device. What did leak came from the systems around the product, where partner lists, support history and applicant files had collected over the years.
Every hardware and deep-tech company has the same kind of side systems. The practical lesson is to find the engineering data and credentials that have drifted into them, move the most valuable files under real access control, and keep records that show who could open what. When the next web server falls, that is what decides whether you lose a contact list or your designs.
Protect the files, not just the servers. CADChain gives engineering teams file-level encryption, per-file permissions, access logs and blockchain proof of ownership for CAD files, across CAD systems and partners.

👉 Protect your CAD files with CADChain

FAQ: Loxone cyberattack

What happened in the Loxone cyberattack?

On 18 October 2026, Loxone detected unauthorised access to its internal IT systems. A group calling itself Samurai defaced the website and claims to have copied about 200 GB of data. Loxone says the attack came through a web server and that CRM partner data, support requests and applicant data were copied.

Are Loxone Miniservers and smart homes affected?

According to Loxone, no. The Miniserver, Remote Connect and Exosphere were not affected and installations keep running. Loxone says user and access data are stored only locally on the Miniserver and that it keeps no central database of customer installation credentials.

Who is behind the Loxone attack?

A group calling itself Samurai claimed the attack on Loxone's defaced website. Its ransom note claims 201.6 GB was copied and encrypted. Loxone has not confirmed the volume or whether a ransom was demanded.

Was Loxone source code stolen?

Loxone told heise that no source code, payment card data or sensitive product information was obtained, and its updates say the codebase was checked and is not compromised.

What should Loxone partners and customers do?

Treat unexpected emails carefully, especially from lookalike domains such as loxon.com or luxone.com. Loxone never asks for passwords and its bank details have not changed. Change any Miniserver password that was ever sent by email or in a support ticket, and enable two-factor authentication when it becomes available.

Does the Cyber Resilience Act apply to this incident?

The CRA requires manufacturers to report actively exploited vulnerabilities and severe incidents that affect the security of their products. Loxone says its products were not affected. Personal data in the CRM and applicant system falls under the GDPR.

What can other manufacturers learn from the Loxone attack?

Technical data and credentials often collect in CRMs, ticket systems, partner portals and applicant tools. Map those systems, remove secrets from them, use two-factor authentication, prepare a partner warning and keep valuable design files under file-level access control.

How does CADChain help after a breach like this?

CADChain encrypts CAD files and enforces per-file permissions, so drawings and models attached to tickets or shared with partners cannot be opened without permission. It also logs every access.
2026-10-25 13:22 News