Samurai is the name used by an extortion claimant linked in Krone’s reporting to the October 2026 Loxone incident. Its operators and relationship to known groups are unclear.
Loxone is the reported victim. This single incident does not establish a broader targeting pattern.
The claimant reportedly used a website defacement to allege data copying and encryption and threaten publication. Those assertions do not verify the volume or encryption.
The reported demand indicates financial extortion. Nationality, membership, a ransomware family and an affiliate model remain unknown.
Krone reports a Samurai claim of 201.6GB copied and encrypted, with threatened publication Oct.22 without a payment agreement. Volume, encryption and responsibility remain unverified; operator identity and relationship to known groups are unclear.
