Austrian smart home manufacturer Loxone has fallen victim to a ransomware attack. Before the same number of theories spring up around it as did last year over the alleged ESP32 “backdoor,” let’s look at what we actually know. Your Miniserver is safe, and the critical PHP vulnerability has nothing to do with the attack.
What happened
On Sunday, October 18, Loxone detected an attack on its internal IT systems. The ransomware group SAMURAI claimed responsibility. It says it took around 200 GB of data and is threatening to publish it. The attackers also changed Loxone’s website homepage, so ordinary visitors learned about the attack too.
According to the company’s management, the attack came through one of its web servers. Loxone isn’t disclosing the exact attack path for security reasons, but says it has identified and closed it. The company has informed the authorities, brought in external forensic specialists, and has a 25-person team working around the clock on the response.
What was leaked
According to Loxone, the data mainly includes:
- contact details for partner companies, mostly electrical installers,
- technical support requests,
- job applicant information.
The company says some of the data is outdated. Payment cards and bank details were not affected. Loxone is contacting people whose data it has confirmed was leaked by email.
One thing is worth noting. Loxone reviewed its support history for cases where partners or customers had sent installation credentials in plain text. If you’ve ever put your Miniserver password in a support ticket, change it.
What wasn’t affected
The Miniserver runs locally. It doesn’t need Loxone’s servers or an internet connection to operate, and user accounts are stored on the Miniserver itself, not in the manufacturer’s cloud. An attack on the company’s CRM therefore has no way to reach your building controls.
Loxone also says that Remote Connect, Exosphere, its cloud mailer, and push notifications run on separate infrastructure and were not affected. The same goes for accounts on loxone.com. The company also checked its entire codebase and says it wasn’t compromised. Software signed by Loxone really does come from Loxone.
And what does PHP have to do with it?
Nothing. Not you, and not your Miniserver.
Loxone’s official website mentioned critical PHP vulnerabilities, and some forums immediately linked them to the attack. But the attack happened on October 18, while the PHP vulnerabilities were disclosed by the community on October 20. Loxone only delayed relaunching its website, online shop, and Partner Portal until it could install the patches. Nothing suggests the attack was related to PHP.
If you use Loxone at home, PHP isn’t something you need to worry about. It affects web servers, not the Miniserver. But if you run your own website on PHP, such as WordPress, update it. That advice stands regardless of Loxone.
Let’s not turn this into another ESP32 backdoor story
In March 2025, news of a “hidden backdoor” in ESP32 chips made headlines around the world. At the RootedCON conference in Madrid, security firm Tarlogic presented 29 undocumented HCI commands in the chip’s Bluetooth firmware. Within hours, headlines had turned them into a backdoor in a billion devices. In reality, these were debugging commands for developers that couldn’t be triggered remotely. An attacker would need access to the HCI interface, meaning physical access or code already running on the device. The issue also affected only the original ESP32, not the S, C, or H series. Tarlogic eventually rephrased “backdoor” as “hidden feature.” The issue was assigned CVE-2025-27840 with medium severity, and Espressif promised a software fix to remove the commands.
A similar scenario could play out with Loxone: “Loxone got hacked, so someone can open my house.” Based on everything we know so far, that isn’t true. Company data was leaked, not access to people’s homes.
Could they have stolen the server keys?
We can’t rule it out, and Loxone hasn’t ruled it out either. The company says it has reset or replaced all authentication mechanisms since the attack, rebuilt the compromised CRM interface from scratch, and reviewed its connections with suppliers. Those are all sensible steps when something like this might have happened. Better safe than sorry.
There’s another indirect clue. An email from the SAMURAI group was sent from noreply@loxone.com and passed DKIM checks. So the attackers had access to legitimate company email sending, either through the mail server or its credentials.
As for software signing, Loxone says that software bearing its signature really comes from the company. It doesn’t explicitly say that the signing keys weren’t on the affected systems.
Also, if the hackers (or, more accurately, crackers – the bad guys 🙂 ) had access to the servers, they’d probably have posted on the website itself to show off their “work.”
A sample of the data can still be found on web.archive.
What to watch out for
The real risk right now is phishing. The attackers have contact details for partners, and according to users on loxforum.com, they even sent an email from noreply@loxone.com that passed SPF, DKIM, and DMARC checks. Expect phishing emails that look very convincing.
- Official emails only come from the @loxone.com domain. Watch out for lookalike domains such as @loxon.com or @luxone.com.
- Loxone’s bank details haven’t changed. Ignore any request to pay into a new account.
- Loxone will never ask for your password by email, phone, or text message.
- If you’ve ever shared your Miniserver password by email or in a support ticket, change it.
- Create separate, time-limited accounts for service technicians instead of sharing the administrator password.
What Loxone has done since
Logistics and shipping are running again, and support is responding at support@loxone.com. Loxone Config now has two-factor authentication (version 17.2.10.21), currently in testing. Test versions with 2FA are also running for the Partner Portal and Exosphere. The company says no incidents have been detected on customer installations.
Sources
Loxone: Information about the cyberattack
heise.de: Loxone is the victim of a cyberattack
ooe.ORF.at: Cyberattack on Loxone
loxforum.com: Has Loxone possibly been hacked?
