English (UK)

Important information about a cyberattack on LOXONE

Latest updates

  1. Update: Major progress in bringing our systems back into operation

    Since the cyberattack became known, our teams have been working around the clock together with external IT security and forensics experts to restore our systems securely and fully resume regular operations.

    Over the past 24 hours, we have made significant progress. Numerous systems and business processes have been successfully restored and subjected to extensive security checks.

    Website, webshop and Partner Portal technically restored

    Our website, webshop and Partner Portal have been technically restored. Extensive internal and external penetration tests have been completed successfully, and the systems have been approved internally for return to operation.

    Before making them publicly available again, we are still waiting for an important security update: on 20 October, the PHP community announced two critical security vulnerabilities that have drawn increased attention worldwide. A corresponding security update has been announced.

    We have therefore decided to install the latest security updates directly as part of the restoration, before making the affected systems publicly accessible again.

    Comprehensive review and hardening of our IT infrastructure

    At the same time, we have implemented far-reaching measures to review our systems and bring them back into operation:

    • Full review of our codebase & development environment: Our entire codebase has been examined for anomalies and potential security vulnerabilities. This confirmed that our codebase was not compromised by the attack.
    • Software signature: It is ensured: software with a LOXONE signature comes from LOXONE.
    • Decryption of affected databases: We were able to successfully decrypt the databases encrypted by the attackers for analysis purposes.
    • CRM data interfaces rebuilt: Our affected middleware has been set up again from scratch. Internal and external penetration tests have been completed successfully.
    • Authentication: All authentication mechanisms have been set up again or rotated.
    • Supplier connections restored: The technical connections to our suppliers have been checked for potential vulnerabilities and restored.

    Additional precautions for customer installations

    We have specifically checked affected systems, data sets and communication histories to see whether customers or partners have sent us access credentials for customer installations in plain text in the past. The partners concerned have already been informed proactively, and appropriate security measures have been initiated.

    As a reminder: LOXONE has no access to customer installations. The user and access credentials for the Miniserver are known only to the person who sets them up and to those with whom they are shared.

    Worldwide logistics and shipping back in operation

    Our warehousing, picking and shipping processes have been restored. In addition to our headquarters, our logistics sites in the USA, the UK and Switzerland are also back in operation. This means worldwide delivery of our products is running again.

    Normal operations largely restored – security team still working around the clock

    We have taken decisive steps to restore our systems and business processes and to secure them comprehensively.

    While our employees worldwide have already resumed regular operations, our 25-strong Security Incident Response Team – made up of internal IT specialists, external cybersecurity experts and IT forensics specialists, as well as the owners and top management – remains on duty 24/7.

    Together, they are doing everything they can to make the remaining services fully available again as quickly and securely as possible.

    Thank you to our customers, partners and the entire LOXONE community for your trust, patience and tremendous support over the past few days.

  2. Update: More Information & Continued System Recovery

    We’ve added a new FAQ section to our website, providing clear answers to the most frequently asked questions from our customers and partners. We want to make it as easy as possible for everyone to find reliable, transparent and up-to-date information.

    At the same time, we’re continuing to work at full speed to bring our remaining systems back online. Security remains our top priority. As part of this process, we’re taking the latest security developments into account and ensuring that all necessary protective measures are in place before restoring services.

  3. Update: Our headquarters logistics are back up and running!

    Our headquarters logistics operations are up and running again! We have resumed order processing and shipping from our headquarters.

    For the time being, please continue to place your orders via email at orders@loxone.com.

    We’re continuing to bring our remaining systems back online step by step, with security checks at every stage.

    Thank you for your patience and support!

  4. Update: Step by step, we’re back for you.

    We are continuing to bring our systems back up, with checks at every stage, and there is good news: the Intercom’s remote video function is working again, LOXONE Radio is available again, and our technical support can be reached again from now on at support@loxone.com.

    Until further notice, you can send urgent orders by email to orders@loxone.com. Unfortunately, deliveries will take a little longer. We are working flat out to get our logistics running safely again as quickly as possible.

    We have also informed our LOXONE Partners about the current status by email. Please check your inbox.

    As a reminder: buildings with a LOXONE Miniserver are secure. User and access credentials are stored exclusively locally on the Miniserver, not at LOXONE. Miniserver, Remote Connect and Exosphere are not affected.

    Our team continues to work around the clock to bring all systems safely back into operation. Thank you for your patience and support. We will keep you informed transparently.

  5. Update on the cyberattack on LOXONE

    My building, my data: buildings with LOXONE are secure. User and access credentials are stored exclusively locally on the Miniserver, not at LOXONE. Miniserver, Remote Connect and Exosphere are not affected.

    What we are doing:

    • Since early Sunday morning, a team of 25 people – IT security experts, developers, the owners and top management – has been working around the clock in shifts.
    • All affected systems were isolated immediately. We have identified the attack vector and confirmed it together with external IT forensics specialists.
    • We are now bringing our systems back up step by step, with checks at every stage, so that we can be there for our customers as usual.
    • This morning we briefed all employees on the current situation in a town hall meeting and gave clear instructions on how to deal with it.

    Internal company systems are affected, in particular our CRM systems containing data on our partner companies, as well as applicant data. We are currently checking exactly which data is affected. We will inform those affected directly by email.

    For security reasons, we are not describing the attack vector publicly. Thank you for your understanding.

    Thank you for the strong support from our community. We will keep you informed transparently.

What happened

On 18 October 2026, we detected a cyberattack on internal company systems. Our CRM system and our applicant management system are particularly affected. The exact scope is still being investigated.

Our customer installations and the services relevant to their operation are not affected by the attack.

Miniserver, Remote Connect and Exosphere are not affected

LOXONE Miniservers operate locally and independently of LOXONE services, with their own credentials. They control the building technology autonomously on site. Remote Connect, Exosphere and other services are not affected either. LOXONE installations continue to run without restriction. From the very beginning, the Miniserver architecture has relied on local users, with no central point of attack.

What we are doing

Since the attack became known, a team of internal IT specialists, external cybersecurity experts and IT forensics specialists, together with the owners and top management, has been working around the clock to investigate the incident and restore our systems securely.

We immediately isolated the affected systems, launched comprehensive forensic investigations and identified the attack vector. The relevant authorities have been informed.

We are taking particular care when bringing systems back online: before being released again, all affected systems undergo comprehensive security checks and intensive internal and external penetration tests. Only once they have passed these checks do we bring them back into operation step by step.

People whose data has demonstrably been affected will be informed directly, in accordance with the legal requirements.

We will keep you informed transparently about new findings and further progress in restoring our systems.

Frequently asked questions

Are LOXONE installations affected by the cyberattack?

No. LOXONE customer installations are not affected and remain fully operational. Miniservers operate locally and independently of LOXONE’s company infrastructure, ensuring that building automation continues to function as usual.

Are Remote Connect and Exosphere affected?

No. Neither Remote Connect nor Exosphere is affected by the incident, and both remain available. The infrastructure supporting these services is separate from the affected internal systems. Their security was thoroughly investigated by our internal security team and external IT forensics specialists before we confirmed that they were not affected.

Are LOXONE.com accounts and passwords affected?

Based on our current findings, there is no indication that LOXONE.com accounts or their passwords have been compromised. Our authentication infrastructure is hosted separately from the affected internal systems.

Should new information emerge, we will inform users accordingly.

Has personal or business data been stolen?

Based on our current investigation, we assume that data was copied from internal company systems, particularly our CRM and applicant management systems.

This may include business partner contact information, support requests and applicant data. We are continuing to investigate the exact scope and will inform affected individuals in accordance with legal requirements.

Are credit card details or payment information affected?

No. Credit card information and banking details are not affected by the incident.

What is LOXONE doing to resolve the incident?

Together with external cybersecurity and IT forensics experts, our team has been working around the clock since the incident was detected.

We immediately isolated affected systems, identified the attack vector and are restoring our infrastructure step by step. Before bringing affected services back online, we conduct internal and external security assessments, including penetration tests and security audits. The relevant authorities have been informed.

Can I currently place orders?

Yes. Our headquarters logistics operations have resumed, and order processing and shipping are running again.

For the time being, please continue sending your orders to orders@loxone.com.

Is LOXONE Support available?

Yes. Our technical support is available again via support@loxone.com and our usual telephone support channels.

How will LOXONE keep customers and partners informed?

We are committed to transparent communication and will continue publishing verified updates on our official website and communication channels.

Where specific security measures are required, we will contact the relevant partners or individuals directly.

Is the Partner Portal currently available?

The LOXONE Partner Portal is temporarily unavailable because it was hosted on an affected server. We are working on restoring it securely.

Importantly, partner login credentials are managed on separate infrastructure and are not affected by the incident.

Does LOXONE ask for my password?

No, never. LOXONE will never ask for passwords or login details by email, phone, text message or social media. Any such request is a scam, even if it looks genuine. Don’t click any links, don’t enter any details. If you’ve already entered your login details, change your password immediately.

Press

Cyberattack on LOXONE: Customer Installations Protected and Still Safe to Use

Press release · Kollerschlag, Austria, 19 October 2026

Download press release (PDF)
Florian Wöss, President of Loxone Electronics GmbH
Florian Wöss, President of Loxone Electronics GmbHDownload press photo (JPG)

Your contacts

If you have any questions, you can reach us around the clock:

Emailsupport@loxone.com