AfD Breach Exposed 345,439 Emails, HIBP Says

The breach notification service Have I Been Pwned (HIBP) has added a breach of Germany’s Alternative für Deutschland (AfD) party to its database, putting the number of unique email addresses exposed at 345,439. The entry, added on 27 October at 07:01 GMT, lists email addresses and email messages as the data involved. HIBP has marked the breach as verified.

The AfD said on 20 October that a hosting provider it uses had been attacked and that data stolen at the time had now been made available through an activist website. In its statement, the party calls the attack illegal and “an attack on the German party system and thus on democracy” (TSN’s translation).

In brief

Have I Been Pwned lists 345,439 unique email addresses, plus email messages, in the AfD breach, which it dates to 9 September 2026.
The AfD says a hosting provider was attacked, that it told the mailbox owners and the data protection commissioner, and that it has reported both the attack and the publication.
The attackers’ own account of how they got in has not been verified by any official source.

What Have I Been Pwned has confirmed

HIBP, run by the security researcher Troy Hunt, loads breached data so that people can check whether their address appears. Its AfD entry gives a breach date of 9 September 2026. HIBP says that in October “hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files”.

It has also classed the AfD breach as sensitive. Under HIBP’s rules, sensitive breaches “may not be publicly searched”: an address can be checked against them only by its verified owner, after signing in. HIBP gives this protection to breaches where appearing in the data could itself harm someone.

HIBP says the AfD blamed an attack on a hosting provider, “identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH”.

What the AfD says

The party’s statement says the attack on its hosting provider took place “at the end of September 2026”. “Although only a few mailboxes were illegally copied, large amounts of data were taken,” the federal party says. It says it told the owners of those mailboxes straight away, informed the data protection commissioner, is in close contact with the security authorities and has reported both the attack and the publication of the data.

The AfD also disputes how the material has been presented. It says the contents of the stolen documents appear to have been analysed “with a very rudimentary AI”, and that this was about keywords rather than context. In its view, the alleged scandals published so far fail to stand up to scrutiny. TSN has not examined the leaked material and does not report its contents.

The attackers’ account, which no official source has verified

The most detailed technical account comes from the IT security researcher Lilith Wittmann, who published an analysis on 20 October based on statements from the attackers and from people close to the party’s service providers. None of it has been confirmed by the AfD or by the authorities. The Register reports that “No official sources have verified the hackers’ claims”.

According to that account, the way in was a poorly protected WordPress site on a campaign subdomain, where the attackers installed a plugin that gave them access to the server’s command line. From there, they say, they reached the mail administration, changed email passwords and pulled data out through file-hosting services and bulk IMAP requests.

The attackers say the intrusion was noticed on 9 September after about 180GB had been taken, but that code they left on the servers was not found. They say they took data again on 14 September, and that in total they had access to about 300 mailboxes holding about 1.8TB, of which about 300GB was taken. The Register puts the amount taken at more than a terabyte. The attackers also told Wittmann that they are not funded by any state.

Those dates differ from the party’s own. The AfD’s statement places the attack at the end of September; HIBP dates the breach to 9 September.

Why a shared mail host turns a few mailboxes into 345,439 addresses

The AfD says only a few mailboxes were copied. HIBP counts 345,439 unique addresses. Both can be true, because a mailbox holds the addresses of everyone its owner has written to or heard from: party staff, but also members of the public, suppliers, officials and journalists. That is why the HIBP figure matters to far more people than the party itself. Many of those people never used the AfD’s systems, and Wittmann asks whether they too should have been told, as Article 34 of the GDPR generally requires when a breach is likely to pose a high risk to people’s rights and freedoms.

The reported entry route is also a familiar one. A campaign website and a mail system run by the same small provider is a common set-up, and it means a weakness in the least important system can expose the most sensitive one. Hosting firms with many customers have become targets in their own right, as GMO’s Desktop Cloud hack and the website vendor breach at Japan’s Digital Agency showed this month.

The AI summaries add a newer problem. They make a huge cache searchable in minutes, but summaries can also strip out context, which is precisely the party’s complaint. Wittmann says many of the emails can be checked using their DKIM signatures, which show whether a message was altered after it was sent. Even so, a signature can confirm that an email is genuine, but a machine-written summary of it is a different thing.

For anyone who has corresponded with the party, the practical risk is phishing. Real email threads are excellent material for convincing fake replies, as the Capcom ID breach showed with email records on a much larger scale. People can check whether their own address is affected by signing in to HIBP.