Building automation provider Loxone is the victim of a cyber attack
The Austrian building automation company Loxone fell victim to a cyberattack over the weekend, during which a criminal group gained access to internal servers and copied data. The investigation is ongoing, but customer systems were reportedly unaffected. Loxone has informed the relevant authorities and is working with external IT forensics experts to investigate the incident. According to the company, user and access data are stored locally on the Miniserver and not hosted by Loxone, meaning attackers could not access them. Additionally, the attackers did not obtain credit card information, source code, or sensitive product data. The affected systems include internal CRM software and the website database, which have been isolated and are being gradually restored. The attackers allegedly copied around 200 GB of data, including contact details of partner companies, support requests, and candidate data. Some of this data is outdated, such as corporate email boxes and pay slips. Screenshots of the defaced website show data from a community project called 'loxwiki,' which Loxone clarified is not operated by the company.
Hackers have breached the IT systems of Martin Luther University Halle-Wittenberg, gaining access to data from approximately 51,000 applications. The affected applications include those for the summer semester of 2026 and the winter semester of 2026/2027. According to the university, the data has likely been accessed by the attackers. The breach involves names, addresses, phone numbers, private email addresses, birth dates, study program information, admission status, and application process details. The university stated that applicants might have uploaded documents with their applications, which could also have been accessed. It is currently being investigated whether and to what extent these data have been published online. The university became aware of the incident on Wednesday and established a crisis team. Affected individuals are being informed continuously. Relevant authorities have been notified, and criminal charges have been filed. Details regarding the nature of the attack were not disclosed initially. A similar cyberattack was detected at Ludwig Maximilian University Munich in mid-September. Reports suggest that up to 600,000 data sets from the past 50 years may have been affected, potentially including students' bank details. However, it is unclear whether the two attacks are related. Separately, the Austrian building automation company Loxone fell victim to a cyberattack over the weekend. Criminals gained access to internal servers and copied data. Investigations are ongoing, but customer systems are reportedly unaffected. Loxone has informed the relevant authorities and is working with external IT forensics experts to investigate the incident. Loxone has posted information about the IT incident on its corporate website. The company assured users that login and access data are stored locally on the Miniserver and not at Loxone. Systems such as Miniserver, Remote Connect, and Exosphere are not affected. Loxone clarified that it does not host a database with customer installation access data, meaning the attackers could not access this information. Additionally, credit card data, other payment data, source code, and sensitive product information were not compromised. According to Loxone, the internal CRM system and the website database were damaged. All affected systems have been isolated and are being gradually restored after inspection. The data copied by the attackers primarily consists of contact information for partner companies, especially electrical installation businesses, along with support requests and applicant data. Some of this data is outdated, including corporate mailboxes, inbox samples, and pay slips. A defacement of the Loxone website over the weekend indicated that a group named “Samurai” executed the attack and allegedly copied around 200 gigabytes of data. Loxone did not comment on ransom demands or the method used by the attackers, although IT teams have identified and sealed the entry point. Customer operations remain unaffected, though the website and online shop are still offline. Screenshots of the defacement can still be viewed on the Loxforum. The listing includes Confluence data, which Loxone explained is not operated by them and does not run on one of their domains. They also do not use Confluence internally. The listing of apparently copied data is more detailed there, including information about Microsoft 365 accounts, SSO login information, and a registry of Miniservers with 300,000 serial numbers and project names. Affected individuals from the data leak will be contacted directly via email by Loxone. Earlier this weekend, a cyberattack on the consortium FLC caused disruptions in construction work on the Fehmarn Belt Tunnel.
Go to the primary sources (2)
The official sources this coverage is built on. Read them directly to bypass framing.
The Martin-Luther University Halle-Wittenberg has been the victim of a cyberattack, during which hackers may have accessed data from approximately 51,000 applications. The affected data includes names, addresses, phone numbers, private email addresses, birth dates, study program information, admission status, application process details, and uploaded documents. The university is currently investigating whether any of this data has been published online. The incident was discovered on Wednesday, and the university has established a crisis team to inform those affected and notify the relevant authorities. Additionally, the university has filed a criminal report. Separately, the Ludwig-Maximilians-University Munich was also hit by a cyberattack earlier in September, potentially affecting up to 600,000 data sets over the past 50 years.
Bias read (Center): The article reports on a cybersecurity incident at two universities without taking a stance on the issue. It provides factual details about the breach, the data involved, and the university's response, while mentioning another similar attack at LMU Munich. There is no evident ideological framing, sl
Why factuality (98): The article accurately reports the data breach at the University of Halle-Wittenberg, citing specific numbers (51,000 applications), affected semesters (Summer 2026 and Winter 2026/2027), and types of data compromised (names, addresses, emails, etc.). It also mentions the university’s response (esta
Why objectivity (95): The tone remains largely neutral and factual throughout, avoiding overtly emotional or biased language. While it uses phrases like 'Tausende Bewerbungsdaten gestohlen?' (Did thousands of application data get stolen?), this is a standard journalistic question rather than an opinion. The article prese
The Austrian building automation company Loxone fell victim to a cyberattack over the weekend, during which a criminal group gained access to internal servers and copied data. The investigation is ongoing, but customer systems were reportedly unaffected. Loxone has informed the relevant authorities and is working with external IT forensics experts to investigate the incident. According to the company, user and access data are stored locally on the Miniserver and not hosted by Loxone, meaning attackers could not access them. Additionally, the attackers did not obtain credit card information, source code, or sensitive product data. The affected systems include internal CRM software and the website database, which have been isolated and are being gradually restored. The attackers allegedly copied around 200 GB of data, including contact details of partner companies, support requests, and candidate data. Some of this data is outdated, such as corporate email boxes and pay slips. Screenshots of the defaced website show data from a community project called 'loxwiki,' which Loxone clarified is not operated by the company.
Bias read (Center): The article provides a balanced account of the cyberattack, focusing on technical details, the scope of the breach, and Loxone’s response. There is no evident ideological framing, loaded language, or one-sided sourcing. The report includes direct quotes from Loxone and mentions their actions without
Why factuality (85): The article accurately reports the cyberattack on Loxone, citing specific details such as the breach of internal servers, the involvement of criminal groups, and the company's response including informing authorities and working with external IT forensics. It provides direct quotes from Loxone regar
Why objectivity (95): The article maintains a neutral and factual tone throughout, presenting the incident objectively without apparent bias or emotional language. It clearly separates confirmed facts from ongoing investigations and avoids speculative statements.
The article reports on two distinct developments: a data breach involving the German political party AfD and strong financial results for Meta Platforms. Regarding the AfD, unknown hackers leaked over 400,000 emails and 50,000 documents, prompting the party to attempt damage control while remaining silent on further details. It remains unclear whether the party notified data protection authorities as required by GDPR, despite claiming to have informed their internal data officer, as state regulators in Berlin and North Rhine-Westphalia report having received no such notification. The Federal Office for Information Security (BSI) has taken up the case. In parallel, Meta Platforms reported a tripling of net profit in the third quarter, driven by increased advertising revenue and higher prices, alongside a user base of 3.64 billion daily active users. However, operating margins were squeezed by rising costs related to AI data centers and legal settlements, including a recent ruling in New Mexico that ordered Meta to pay $25 billion for systematically misleading users about privacy practices.
Bias read (Progressive): The article frames the AfD's handling of the data leak with critical language, highlighting the party's attempts to 'downplay' the incident ('herunterspielen') and noting the discrepancy between the party's claims and the lack of awareness among regulatory authorities. This emphasis on potential non
Why factuality (85): Accurately reports the leak details (approx. 400k emails) and the legal obligation under GDPR, noting the discrepancy between the party's claim and the authorities' knowledge. It faithfully reflects the primary source's stance on not verifying authenticity while adding relevant external context rega
Why objectivity (80): Maintains a neutral journalistic tone. While it uses terms like 'damage limitation' (Schadensbegrenzung), this is standard political reporting terminology rather than overt editorializing. The inclusion of unrelated business news (Meta) does not affect the neutrality of the specific section covering
HandelsblattIndependent🔒CenterFactual: no official source document/info detectedObjective 50
The provided text consists solely of a headline stating that hackers have apparently stolen hundreds of thousands of emails belonging to the Alternative for Germany (AfD) party through a cyberattack. No further details regarding the specific nature of the breach, the identity of the attackers, or the potential political implications are included in the supplied excerpt.
Bias read (Center): The input text is limited to a single headline containing no body copy, quotes, or contextual framing. While the subject matter involves a major political party and a security incident, which is inherently high-charge, there is insufficient content to evaluate word choice, emphasis, or sourcing bias
Why factuality: no official source document/info detected
Why objectivity (50): No body text available to judge balance or bias. The title is straightforward. The score is neutral due to the lack of substantive content for evaluation.
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
Germany
