Germany's far-right Alternative für Deutschland (AfD) has confirmed a cyberattack on a hosting provider it uses. Self-described hacktivists have published a dataset they say holds roughly 421,000 internal party emails. The AfD confirmed the incident to Bild, AFP and dpa. It has not confirmed how much data was taken, and it describes the scope as "parts of a few mailboxes, most of which had not been used for years." None of the sources available here is a primary statement, regulator filing or CERT advisory. The record count comes from the leakers themselves. One independent analyst says the data looks genuine, and heise online did a first review of the dataset, but no one has verified it in full. The attackers also claim that someone offered them money to take the leak site down. Only Cybernews puts a figure on that offer: €100,000.
What Happened
The dataset appeared on Monday, October 19, on an anonymously run website, according to taz and derimeter. Cybernews reports that the claims were also posted on a well-known hacker forum. The data is available as a full BitTorrent download. The site also offers a searchable interface that shows summaries of individual email threads (heise, WDR).
Accounts of what was actually published differ. Euronews reported that the website published summaries of some emails but not the original messages. heise, taz and WDR all describe a downloadable archive of roughly 280GB alongside the summaries. heise says it examined that archive directly.
The AfD's account, as reported by Cybernews, Euronews, WDR and derimeter: - In September 2026, attackers hit a hosting provider the party uses. Handelsblatt, cited by derimeter, places the attack at the end of September. - "Parts of a few mailboxes," mostly dormant for years, were "apparently copied unlawfully." - The party says the attack was "quickly detected and stopped," that all affected users were informed, and that current federal party mailboxes were not affected.
Other reporting challenges the party's account: - WDR reports that the affected mailboxes include the North Rhine-Westphalia (NRW) state association's current address, which is still in use. WDR also says sources inside the party suggest that "significantly more" accounts may be affected than currently known. - derimeter reports that the party-owned company Alternita was affected, along with mailboxes of the NRW and Mecklenburg-Western Pomerania state associations. It says some AfD mailboxes stopped working in the weeks before the leak and were shut down. derimeter also reports that Germany's Federal Office for Information Security (BSI) is involved. No other source here confirms that. - The NRW AfD told WDR it is reviewing the incident and has announced legal action. The federal party says it is reviewing what has been published.
Attribution is unresolved. Euronews and taz say it is unclear who is responsible. Mirko Ross of security firm Asvin told heise: "This doesn't look like an insider job to me, but rather hacktivism." According to statements quoted by heise and taz, the attackers say they could have destroyed the servers and backups but chose to expose the party's "degeneracy and hypocrisy" instead.
The attackers told International Cyber Digest that an unknown party offered them money to take the leak site offline, and that they refused (heise, taz). taz describes the offer only as "a large sum." The €100,000 figure appears only in Cybernews, attributed to the hacker, and is unverified. heise also reports that the attackers say the leak site was hit with a DDoS attack after it went live.
What Was Taken
The sources broadly agree on the email count but differ on the other figures.
- Emails: about 420,000 (heise's own first review), 421,000 or "more than 421,000" (Cybernews, Euronews, taz, Tichys Einblick), and 421,179 (derimeter, citing the publishers' own figure). All of these trace back to the leakers' claim or to the archive they published.
- Archive size: 280GB (heise, WDR), 281GB (taz, DW, derimeter), and "nearly 300GB" (Cybernews).
- Mailboxes: 10, according to heise and derimeter. They include the Federal Arbitration Court, the federal headquarters contact address, and an account in the name of former co-leader Alexander Gauland. Bild, cited by Euronews and taz, reports emails from co-leader Alice Weidel, and taz adds Beatrix von Storch and Jörg Meuthen.
- Files: these figures are not consistent with each other.
- Cybernews: the hacker claims "over 100,000 files."
- heise: just over 41,000 PDFs, 3,480 DOCX files, and several SQL database dumps.
- derimeter: about 39,000 attachments and 49,000 documents.
- Source systems: Cybernews says the hacker claims data came from more than 800 hosts tied to the party's domain. heise's more cautious assessment points to several web servers and at least one mail server.
- Time span: 2014 to autumn 2026 (taz, Tichys Einblick). The latest message is dated September 12, 2026, according to derimeter, citing the leak platform.
- Sensitive content (reported, not independently verified):
- ID card photos, bank statements, membership applications and local membership lists (Bild, via Euronews)
- Academic certificates (DW)
- Financial records and identity documents (Tichys Einblick)
On the leak site, about 39,000 emails have AI-generated summaries. Of those, 611 are labelled "critical" (possible criminal conduct) and 10,450 are labelled "high" relevance (taz). These are the leakers' own labels and do not show that any wrongdoing occurred.
On authenticity, Cybernews calls the emails unverified. Berlin security researcher Lilith Wittmann said she considers the data genuine and called the method of access "plausible" (taz, Tichys Einblick). WDR notes that the summaries match many episodes already known from public reporting, which supports authenticity but does not prove it.
Why It Matters
- Third-party hosting is the weak point. The AfD says the breach happened at its hosting provider, not on its own systems. Organisations that outsource mail and web hosting still own the exposure when the provider is breached.
- Dormant mailboxes still hold sensitive data. The party's defence that most mailboxes were "not used for years" is a risk factor, not a mitigation. Old accounts still contained ID scans, bank statements and membership lists, and at least one affected mailbox (NRW) is reportedly still active.
- This is a hack-and-leak, not ransomware. There was no extortion demand. The goal is exposure, and the leakers made the data searchable, published AI-generated summaries, and wrote guides pointing journalists toward possible financial irregularities (heise). That combination maximises damage to reputation and politics, and it will likely be copied against other political targets.
- Political timing. The AfD leads national polls and came first in two state elections in September (Euronews). Leaks like this feed directly into political debate, including the ongoing discussion of a possible ban proceeding (heise).
- Further publication is likely. The leak site is live, the reported offer to buy it down was refused, and party sources expect more affected accounts to surface. More material may come out.
The Attack Technique
Technical detail is limited, and nearly all of it comes from the attackers.
- Initial access: the attackers say they got in through an "outdated website" (heise). This suggests exploitation of unpatched or abandoned web software on infrastructure at the hosting provider.
- Lateral movement: heise's analysis indicates data was copied from several web servers and at least one mail server. That suggests the attackers moved from the web tier into mail storage on the same infrastructure. The claim of more than 800 hosts (Cybernews) has not been corroborated.
- Reconstruction: Wittmann and the outlet Hoodinformatik say they spoke with the alleged hackers and with people close to the AfD's IT providers, and were able to reconstruct how the attack probably unfolded (Tichys Einblick). The full technical details are not in the sources reviewed here.
- Capability: the attackers say they had enough access to destroy servers and backups (heise, taz). If that is true, it implies administrative-level control. This has not been verified.
- Detection: the party says it detected and stopped the attack quickly. Yet derimeter reports that mailboxes were failing weeks before the leak, and the newest email is dated September 12. It is unclear how long the attackers had access before they were cut off.
What Organizations Should Do
- Inventory and retire stale web assets. Find legacy sites, forgotten CMS installs and test subdomains on shared hosting, then patch them or take them down. An "outdated website" was the claimed way in here.
- Hold hosting providers to security standards in contract. Require patch timelines, separation between customer web and mail workloads, breach notification windows, and logs you can access. Ask how a web-tier compromise would be stopped from reaching mail storage.
- Decommission or archive dormant mailboxes. Disable unused accounts, export their contents to encrypted cold storage with strict access controls, and apply retention policies so mail servers don't keep years of sensitive history.
- Keep identity and financial documents out of email. Move ID scans, bank statements and membership data into dedicated systems with access logging and encryption, not inbox attachments.
- Plan for hack-and-leak, not just ransomware. Pre-agree legal, communications and member-notification playbooks for public data dumps. Don't play down the scope early, because downplaying that later evidence contradicts damages credibility.
- Monitor for exfiltration and early warning signs. Alert on bulk IMAP or mailbox exports and large outbound transfers. Treat unexplained mailbox outages as possible security incidents until shown otherwise.
Sources: AfD Data Leak: Hacker Claims 421,000 Emails Stolen Cybernews | Massive AfD data breach exposes illegally copied files heise online | Hackers steal 421,000 emails belonging to members of Germany's far-... | Germany news: Hackers release AfD party emails | Interne E-Mails öffentlich: AfD blamiert sich mit Datenleak taz.de | NRW-AfD zu Hackerangriff auf Partei | Der Hacker-Angriff auf die AfD - was der Partei nun droht | AfD-Datenleck: 421.000 interne Mails im Netz