More than 345,000 unique email addresses were exposed in a hack that targeted the email hosting provider for Alternative for Germany (AfD), Have I Been Pwned confirmed on Oct. 27, 2026. The party had officially disclosed a September attack on its hosting provider only last week.
Have I Been Pwned confirmation and AfD's official account
Have I Been Pwned — the widely used breach notification service — publicly confirmed the scale of the incident for the first time on Oct. 27, 2026. AfD issued an internal statement acknowledging the September attack on its hosting provider and saying “only a few email accounts were illegally copied,” while also admitting “a large amount of the data was taken from them, resulting in an extensive data breach.” The party said it had notified the owners of affected accounts and reported the incident to security authorities.
In an Oct. 20 statement, AfD framed the incident as “illegal and a criminal offense” and “an attack on the German party system and thus on democracy.” The party also warned that “apparently, the content of the stolen documents was analyzed using a very rudimentary AI,” arguing that the AI-focused reporting emphasized keywords rather than context and claiming that “the alleged scandals published so far do not stand up to scrutiny.”
Extent of the exposure: emails, attachments, torrents and terabytes
Reporting describes hundreds of thousands of confidential emails and attachments made public and the wider publication of the material on an “activist website” that summarized email chains into searchable topics. Investigative reporting cited by The Register says the hackers exfiltrated more than a terabyte of data; the party has not disputed that a large volume was taken, while also disputing the interpretation of that content.
The raw email files have been made available for download via torrent, and media outlets including Der Spiegel have sifted through those raw files. Der Spiegel reported that party leader Alice Weidel “seemingly knew about illegal donations related to the 2017 federal elections weeks before she previously said she did,” a specific finding that AfD has not directly addressed in terms of the raw-file veracity.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAlleged attack path: WordPress compromise and Alternita Dienstleistungs GmbH
Investigative journalist Lilith Wittmann reported conversations with the cybercriminals responsible for the hack-and-leak operation and with party sources. According to Wittmann’s reporting, the attack was first spotted on Sept. 9 and began with a compromise of a poorly protected WordPress site. The same reporting said the criminals then gained persistent access to servers operated by the hosting provider identified as AfD-owned Alternita Dienstleistungs GmbH and exfiltrated data from those servers.
The Register contacted Alternita Dienstleistungs GmbH for comment. The reporting also notes that no official sources have independently verified the hackers’ claims about how the attack unfolded.
AI-generated summaries, the “activist website,” and published revelations
The material posted to the activist website included AI-generated summaries that grouped chains into topics. The summaries, according to reporting, included purported views related to Holocaust denial, racist and antisemitic rants, the 9/11 disaster, forged documents and more. AfD has argued these AI summaries are unreliable, reiterating that the analysis “focused on keywords, not the context.”
At the same time, major media parsing the raw files — most notably Der Spiegel — have reported findings drawn directly from the underlying documents, including the reporting about Alice Weidel and alleged prior knowledge of illegal donations tied to the 2017 federal elections. AfD has said it will not comment on whether the emails or the resulting stories are to be trusted.
What this means for technologists, policymakers, and the general public
- Technologists and security teams: Expect renewed scrutiny of WordPress and other web-facing content-management systems, hosting-provider access controls, and long-term persistence detection on party-operated servers; investigators will also need to reconcile claims of >1TB exfiltration with forensic evidence.
- Policymakers and regulators: The party reported the incident to security authorities and characterized the breach as an attack on the party system; regulators and law-enforcement bodies will be asked to establish the facts, confirm the attack path, and assess legal consequences for the breach and the publication of stolen material.
- The general public and media consumers: The availability of raw files via torrent and the publication of AI-generated summaries create competing narratives — direct forensic analysis of files and careful sourcing by reporters will be crucial in distinguishing corroborated findings from contextual or algorithm-driven misreadings.
The facts published so far are concrete about scale — Have I Been Pwned’s confirmation of more than 345,000 exposed addresses and reporting of more than a terabyte of exfiltrated data — but unresolved about method and motive. The party has disputed the interpretation of the material and said it has alerted authorities, investigators have described a WordPress-origin compromise and persistent server access at Alternita Dienstleistungs GmbH, and media outlets have published specific findings from the raw files. Which of those threads will be proven in court or in forensic reports remains to be seen; for now, the documents and their public dispersal have already reshaped the record that parties, journalists and citizens must now parse.
