Loxone's data breach raises the *when did you know* question

When the clock starts

Loxone, an Austrian company that makes building automation systems, has reported an IT security incident ^[1]. According to the company's statement, attackers copied data, though customer systems are said to be unaffected. The details of what was taken, and when, haven't been made public.

The incident itself isn't unusual. What makes it worth looking at is the timing question it raises. Most cybersecurity reporting rules don't count the hours from when an incident happened. They count from when you became aware of it. That's like the bank card rule: the clock starts when you notice the card is missing, not when you last used it.

Under Sweden's Cybersecurity Act, which implements the EU's NIS2 directive, essential and important entities must send an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within a month ^[2]. The Cyber Resilience Act, which applies from 11 September 2026, requires manufacturers of products with digital elements to report actively exploited vulnerabilities and serious incidents via ENISA's common platform, also with short deadlines ^[3].

The hard part is showing, months later, when you first knew. Say a supervisor asks why the early warning went out after 30 hours instead of 24. If the only record of when the security team first saw the alert is in a spreadsheet its author could have edited, that record is easy to challenge.

The evidence question

Incident response is often messy. The first alert might be vague, the escalation might take time, and the decision to report might involve several people. Each step gets recorded somewhere: in a ticket, a log, a Slack thread, an email. The question that comes later is whether those records can be shown unchanged.

A log kept by the same people who could edit it is like a diary. It might be accurate, but proving that takes trust. In a regulatory investigation, trust isn't always enough.

Article 32 of GDPR requires technical measures to protect personal data against unauthorised alteration ^[4]. The Cybersecurity Act doesn't specify how records must be kept, but it does make the timing of awareness matter. If a deadline is missed, the organisation has to explain why, and the explanation has to hold up.

How a digital witness fits here

This is one of the cases where sealing a timeline makes sense. Here's what gets sealed: the first detection note when the security team logs it, the decision to escalate when it's made, and each report as it's sent to the supervisor. The sealing takes a fingerprint of each record, not the record itself, so nothing leaves your systems.

If a supervisor later questions the timeline, anyone you share the records with can check that they're the ones written at the time. Change a single character in a note after it's sealed and the fingerprint won't match.

What it doesn't do: it doesn't show that the response was adequate, that the report was complete or that the incident was significant. Those are judgement calls. What it does is give you a checkable record of when each step was taken.

You seal through WitniumChain's REST API, SDK or MCP server. The content stays with you. The first 2,000 witnesses a month are free.

How it would work

1. Seal the first detection note when the security team logs the alert.
2. Seal the escalation decision and each subsequent report as they're made.
3. If questioned, share the records and let the supervisor check the fingerprints.

What this means for you

If your organisation falls under the Cybersecurity Act or the Cyber Resilience Act, ask yourself these questions:

• Where do we record the moment we become aware of an incident?
• Could we show a supervisor, six months later, that those records haven't changed?
• Who has access to edit them, and would a supervisor accept that as sufficient protection?

The 24-hour deadline for an early warning is tight. The question of when you knew can turn a straightforward report into a difficult conversation. A sealed timeline takes that question off the table.

What to watch

The Cyber Resilience Act applies from 11 September 2026 ^[3]. The Swedish Cybersecurity Act has been in force since 15 January 2026 ^[2]. If you're an essential or important entity under NIS2, or a manufacturer of connected hardware or software, the reporting obligations are already live or coming soon.