Alternative für Deutschland

Summary

A cyberattack on Germany's far-right party exposed over 345,000 unique email addresses and email messages after intruders accessed a poorly secured WordPress site linked to the party's IT infrastructure and moved into its mail management system. The attackers copied data from officials' mailboxes in two separate entries, exfiltrating files later shared through a torrent link and an activist website. The leaked material also included member database excerpts from several state branches and unencrypted population register records involving first-time voters, raising concerns that many affected individuals were not directly notified. The party described the intrusion as an attack on democracy and claimed it promptly informed mailbox owners and the data protection commissioner, though the timing of the official notification has been disputed.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Over 345,000 unique email addresses were exposed in a September 2026 cyberattack on the German far-right political party Alternative für Deutschland. The breach notification service Have I Been Pwned added the data to its database on 27 October 2026, listing email addresses and email messages as the compromised information. Have I Been Pwned flagged the incident as a sensitive breach, meaning the data cannot be searched publicly, though verified owners of email addresses can check whether their address appears by signing in to the dashboard, and organizations can search the domains they control. AfD confirmed in a statement on 20 October that the stolen data had been made accessible through an activist website, noting that the scale of the attack became apparent the day before. The party stated that although only a few mailboxes were unlawfully copied, large amounts of data were leaked, and said it had immediately informed the owners of the mailboxes as well as the data protection commissioner. Investigative journalist Lilith Wittmann disputed that timeline, reporting that the Berlin data protection commissioner received the party's breach notification on the evening of 20 October, about two hours after the press release was issued. AfD described the attack as illegal and as an attack on the German party system and therefore on democracy. The party also expressed concern that stolen documents appeared to have been analyzed with a very rudimentary AI that looked at keywords and ignored context, and said the alleged scandals published so far do not stand up to scrutiny.

Wittmann, who spoke with the hackers and with people close to the company running the party's IT infrastructure, reported that the attackers gained access through a poorly secured WordPress site at wahlkampf.afd.de. From there they reached the mail management system, changed the email passwords of party officials, and began pulling data off the servers. The intrusion was noticed on 9 September and was stopped, but the hackers told Wittmann that malicious code they had left behind went undetected. They used that code to return on 14 September and copy more data before being discovered a second time. The stolen files were later offered for download via a torrent link. The company involved is Alternita Dienstleistungs GmbH, a party-owned firm that provides web hosting, accounting, and other services to AfD branches and manages hundreds of domains for the party. AfD's own account places the attack at the end of September, a timeline that Wittmann wrote contradicts both the available data and the statements of the hackers and of employees of AfD service providers. The hackers' account of how the attack unfolded has not been confirmed by AfD or the authorities.

The people affected by the leak go beyond party officials. Wittmann found that the emails hold excerpts from member databases of several state branches, along with data AfD requested from population registers for campaign purposes. These records include information on young people in Mecklenburg-Western Pomerania who were voting for the first time this year. The data was sent by the registration offices unencrypted by email. German law allows parties to receive such registry data for election advertising, but it must be deleted within a month of the election. AfD said all affected users were informed, but Wittmann argued it is uncertain whether the numerous people whose data is contained in the leaked emails were informed as well, particularly those who were not themselves users of the affected systems. Under Article 34 of the GDPR, people generally have to be notified of a data breach likely to result in a high risk to their rights and freedoms. The hackers told Wittmann they regret publishing data belonging to uninvolved third parties, saying it was never their goal.

Der Spiegel and ZDF, which went through the emails, reported that AfD co-leader Alice Weidel appears to have known about planned donations tied to her 2017 federal election campaign about two months earlier than she has publicly claimed. The breach comes as the party leads national opinion polls, having won state elections in Saxony-Anhalt and Mecklenburg-Western Pomerania the previous month, where Chancellor Friedrich Merz's centre-right Christian Democratic Union suffered heavy losses. AfD has grown into one of the largest political forces in Germany, with immigration driving much of its support since the 2015 refugee crisis. In May 2025 the domestic intelligence service classified the party as a confirmed right-wing extremist organization, a designation a Cologne court provisionally suspended in February.

Sources

Sources available to members: 1 source.