AfD: party's email hosting provider hacked, 345,000 email addresses and mailboxes leaked
AfD party email and web hosting (Alternita Dienstleistungs GmbH)
Hackers broke into Alternita Dienstleistungs GmbH, the party-owned company that hosts web and email for Germany's Alternative für Deutschland (AfD), in September 2026 and copied party officials' mailboxes. The data, hundreds of gigabytes of emails and attachments, was published on an activist website in October. AfD confirmed the attack on its hosting provider on Oct 20, and Have I Been Pwned added the breach on Oct 27 with 345,439 unique email addresses, flagged as sensitive so only verified address owners can search it. The leaked emails also contain member-database excerpts and voter-registry data AfD requested for campaigning.
Why this severity: 345,439 unique email addresses plus full mailbox contents published; includes third-party voter and member data
- Started
- Sep 9, 2026
Affected
- People whose email addresses or data appear in AfD party mailboxes hosted by Alternita
Fixed in
No fixed release yet
Timeline4
Have I Been Pwned adds the breach with 345,439 unique email addresses and email messages, marked as a sensitive breach.
AfD confirms an attack on its hosting provider and says the stolen data was made available through an activist website; journalist Lilith Wittmann reports the attackers got in through a poorly secured WordPress site at wahlkampf.afd.de.
According to the attackers, code left on the servers let them return and copy more mail before being discovered again; about 300 GB was taken in total. Not confirmed by AfD or authorities.
Intrusion at AfD's party-owned hosting provider Alternita is detected and stopped, per people close to the provider; HIBP dates the breach to this day.
Advisories1
News & write-ups3
- Attack on email hosting provider for German far right party AfD exposed 345k accountsThe Register · Oct 27, 2026
- 345,000 email addresses stolen in cyberattack on Germany's far-right party AfDHelp Net Security · Oct 28, 2026
- Zweimal gehackt: Wie 300 Gigabyte AfD-Daten abflossenLilith Wittmann · Oct 20, 2026
Notes & caveats
The attack path (WordPress campaign site, WP-Console, mailbox password changes, IMAP bulk export) comes from the attackers and people close to the provider and has not been verified by AfD or authorities. AfD places the attack at the end of September, which conflicts with HIBP's and Wittmann's Sept 9 date.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
