Austrian building automation maker Loxone detected a cyberattack on its internal company systems on 18 October 2026. According to the company's incident page, the attackers reached its CRM system, which holds data on its installer and partner companies, and its applicant management system. Loxone isolated the affected systems, brought in outside forensic specialists, identified the attack path (it has not published it) and informed the authorities.
The incident became public when pages on loxone.com were replaced with a ransom message from a group calling itself "Samurai", which claimed to have copied and encrypted about 200 GB, according to Austrian and German press reports. Loxone has not confirmed any volume.
What Loxone says was and was not affected:
• Affected: internal CRM and applicant systems, with partner and applicant data. Loxone says it decrypted the encrypted databases for analysis, rebuilt the CRM middleware and rotated all authentication.
• Not affected: Miniservers, which run locally with their own credentials, plus Remote Connect and Exosphere. Loxone says its codebase was not compromised, signed Loxone software is genuine, and no incidents have been reported from customer installations worldwide.
What makes this one worth a closer look for OT and building owners: in its 21 October update, Loxone said it searched the affected systems and support history for cases where customers or partners had sent login credentials for customer installations in plain text, and proactively warned the partners concerned. Its 22 October update adds two-factor authentication to Loxone Config (version 17.2.10.21, in testing) and says all relevant partners worldwide have been contacted by phone.
Building automation controllers often sit next to OT in plants, water and wastewater facilities, data centers and commercial buildings. Installer contact lists and support tickets are exactly what a phishing campaign needs, and a password emailed to a vendor years ago may still open a controller today.
What the Red Tiger team recommends:
1. If you use Loxone or any building automation platform, rotate every credential that has ever been sent to the vendor or an installer by email, ticket or chat.
2. Give each integrator and technician a named account on the controller, and use time-limited accounts for maintenance visits instead of a shared password.
3. Warn facilities, finance and your integrators about follow-on phishing. Loxone flags lookalike domains such as @loxon.com and @luxone.com and says its bank details have not changed.
4. Put building automation on your OT asset inventory and remote access review, so you know which controllers are reachable from outside and who can reach them.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: Loxone incident page (updates 18 to 22 Oct 2026): https://security.loxone.com/enus/
DysruptionHub (20 Oct 2026): https://dysruptionhub.com/loxone-pennsylvania-cyberattack-orders/
Check out our resources and book a follow-up call with our team.
