Austrian building-automation manufacturer Loxone reported on 19 October that intruders reached its internal servers over the weekend, copying data and corrupting its internal CRM and the website's database. Loxone said the data taken centres on CRM records — contact details for partner businesses, chiefly electrical installation firms — plus support requests and applicant data, and described some of it, including corporate mailboxes and payslips, as outdated. Sample data circulating from the breach reportedly includes Microsoft 365 account details, SSO login information and a register of 300,000 Miniserver serial numbers with project names. A group calling itself Samurai defaced Loxone's website and claims roughly 200 GB was copied; Loxone declined to comment on a ransom demand or on the attack path, though it said its IT teams identified and closed the exploited route, and chief executive Florian Wöss told ORF the entry came through one of its web servers. Loxone says customer installations are unaffected because credentials sit locally on the Miniserver and because Miniserver, Remote Connect and Exosphere were untouched, and that it has notified authorities and engaged external forensics. Why it matters: compromising a controller vendor can hand an attacker a map of a widely deployed installed base even while the buildings themselves keep running.

• Source article