Building automation provider Loxone is the victim of a cyber attack

Hackers have breached the IT systems of Martin Luther University Halle-Wittenberg, gaining access to data from approximately 51,000 applications. The affected applications include those for the summer semester of 2026 and the winter semester of 2026/2027. According to the university, the data has likely been accessed by the attackers. The breach involves names, addresses, phone numbers, private email addresses, birth dates, study program information, admission status, and application process details. The university stated that applicants might have uploaded documents with their applications, which could also have been accessed. It is currently being investigated whether and to what extent these data have been published online. The university became aware of the incident on Wednesday and established a crisis team. Affected individuals are being informed continuously. Relevant authorities have been notified, and criminal charges have been filed. Details regarding the nature of the attack were not disclosed initially. A similar cyberattack was detected at Ludwig Maximilian University Munich in mid-September. Reports suggest that up to 600,000 data sets from the past 50 years may have been affected, potentially including students' bank details. However, it is unclear whether the two attacks are related. Separately, the Austrian building automation company Loxone fell victim to a cyberattack over the weekend. Criminals gained access to internal servers and copied data. Investigations are ongoing, but customer systems are reportedly unaffected. Loxone has informed the relevant authorities and is working with external IT forensics experts to investigate the incident. Loxone has posted information about the IT incident on its corporate website. The company assured users that login and access data are stored locally on the Miniserver and not at Loxone. Systems such as Miniserver, Remote Connect, and Exosphere are not affected. Loxone clarified that it does not host a database with customer installation access data, meaning the attackers could not access this information. Additionally, credit card data, other payment data, source code, and sensitive product information were not compromised. According to Loxone, the internal CRM system and the website database were damaged. All affected systems have been isolated and are being gradually restored after inspection. The data copied by the attackers primarily consists of contact information for partner companies, especially electrical installation businesses, along with support requests and applicant data. Some of this data is outdated, including corporate mailboxes, inbox samples, and pay slips. A defacement of the Loxone website over the weekend indicated that a group named “Samurai” executed the attack and allegedly copied around 200 gigabytes of data. Loxone did not comment on ransom demands or the method used by the attackers, although IT teams have identified and sealed the entry point. Customer operations remain unaffected, though the website and online shop are still offline. Screenshots of the defacement can still be viewed on the Loxforum. The listing includes Confluence data, which Loxone explained is not operated by them and does not run on one of their domains. They also do not use Confluence internally. The listing of apparently copied data is more detailed there, including information about Microsoft 365 accounts, SSO login information, and a registry of Miniservers with 300,000 serial numbers and project names. Affected individuals from the data leak will be contacted directly via email by Loxone. Earlier this weekend, a cyberattack on the consortium FLC caused disruptions in construction work on the Fehmarn Belt Tunnel.