Loxone restores systems and warns about shared credentials

What was announced

In its official update at 12:02 CEST on 21 October 2026, Loxone said its website, webshop and Partner Portal had been technically restored and had passed internal and external penetration tests. They are not yet publicly accessible: the company is waiting for an update addressing two critical PHP vulnerabilities announced on 20 October and wants to install it before exposing those services again. Normal operations are largely restored, and logistics sites at headquarters, in the United States, the United Kingdom and Switzerland are shipping again.

Loxone says a full review found no compromise of its codebase. It reports that databases encrypted by the attackers were decrypted for analysis, the affected CRM middleware was rebuilt from scratch, authentication mechanisms were reset or rotated, and supplier connections were reviewed. These are the company's own findings and do not replace an independent audit.

The most practical new point for homeowners and installers is a review of affected data and communication histories for cases where installation access credentials may have been sent in plain text. Loxone says the relevant partners have already been contacted proactively and security measures initiated. This does not mean every home is exposed: the company maintains that it has no access to an installation unless someone shares the credentials.

The earlier FAQ still says internal data was probably copied, potentially including partner contacts, support requests and applicant data. The precise scope remains under investigation. Loxone maintains that Miniserver, Remote Connect and Exosphere were unaffected, that there is currently no indication of compromised LOXONE.com accounts, and that banking and card data are not involved.

Anyone who has ever shared installation credentials with support or a partner should watch for a direct official notice and, if uncertain, change access details together with the installer. Loxone reiterates that it never asks for passwords by email, phone, text or social media. Do not follow links or enter details from unverified messages, even if they appear to come from the brand.