# AfD: party's email hosting provider hacked, 345,000 email addresses and mailboxes leaked · pwn.watch > Hackers broke into Alternita Dienstleistungs GmbH, the party-owned company that hosts web and email for Germany's Alternative für Deutschland (AfD), in September 2026 and copied party officials' mailboxes. The data, hundreds of gigabytes of emails and attachments, was published on an activist website in October. AfD confirmed the attack on its hosting provider on Oct 20, and Have I Been Pwned added the breach on Oct 27 with 345,439 unique email addresses, flagged as sensitive so only verified address owners can search it. The leaked emails also contain member-database excerpts and voter-registry data AfD requested for campaigning. Page: https://pwn.watch/i/afd-alternita-email-hosting-breach-sep-2026 · generated 2026-10-28T17:22:53.988Z ## Status - Severity: medium · status: live · patch: no-fix-needed - Product: AfD party email and web hosting (Alternita Dienstleistungs GmbH) - Started: 2026-09-09 - Affected: People whose email addresses or data appear in AfD party mailboxes hosted by Alternita ## Follow this incident - RSS (one item per update): https://pwn.watch/i/afd-alternita-email-hosting-breach-sep-2026/feed.xml - JSON Feed: https://pwn.watch/i/afd-alternita-email-hosting-breach-sep-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/afd-alternita-email-hosting-breach-sep-2026.json - This file: https://pwn.watch/i/afd-alternita-email-hosting-breach-sep-2026/llms.txt ## Updates (newest first) - 2026-10-27: Have I Been Pwned adds the breach with 345,439 unique email addresses and email messages, marked as a sensitive breach. (https://haveibeenpwned.com/breach/AfD) - 2026-10-20: AfD confirms an attack on its hosting provider and says the stolen data was made available through an activist website; journalist Lilith Wittmann reports the attackers got in through a poorly secured WordPress site at wahlkampf.afd.de. (https://www.lilithwittmann.de/blog/afd-hack-2026/) - 2026-09-14: According to the attackers, code left on the servers let them return and copy more mail before being discovered again; about 300 GB was taken in total. Not confirmed by AfD or authorities. (https://www.lilithwittmann.de/blog/afd-hack-2026/) - 2026-09-09: Intrusion at AfD's party-owned hosting provider Alternita is detected and stopped, per people close to the provider; HIBP dates the breach to this day. (https://haveibeenpwned.com/breach/AfD) ## Fix brief # Security brief: AfD: party's email hosting provider hacked, 345,000 email addresses and mailboxes leaked Source: https://pwn.watch/i/afd-alternita-email-hosting-breach-sep-2026 · status: live · severity: medium · updated Oct 28, 2026, 14:38 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is Hackers broke into Alternita Dienstleistungs GmbH, the party-owned company that hosts web and email for Germany's Alternative für Deutschland (AfD), in September 2026 and copied party officials' mailboxes. The data, hundreds of gigabytes of emails and attachments, was published on an activist website in October. AfD confirmed the attack on its hosting provider on Oct 20, and Have I Been Pwned added the breach on Oct 27 with 345,439 unique email addresses, flagged as sensitive so only verified address owners can search it. The leaked emails also contain member-database excerpts and voter-registry data AfD requested for campaigning. Severity detail: 345,439 unique email addresses plus full mailbox contents published; includes third-party voter and member data - Product: AfD party email and web hosting (Alternita Dienstleistungs GmbH) ## Affected versions - People whose email addresses or data appear in AfD party mailboxes hosted by Alternita ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 27, 2026: Have I Been Pwned adds the breach with 345,439 unique email addresses and email messages, marked as a sensitive breach. - Oct 20, 2026: AfD confirms an attack on its hosting provider and says the stolen data was made available through an activist website; journalist Lilith Wittmann reports the attackers got in through a poorly secured WordPress site at wahlkampf.afd.de. - Sep 14, 2026: According to the attackers, code left on the servers let them return and copy more mail before being discovered again; about 300 GB was taken in total. Not confirmed by AfD or authorities. - Sep 9, 2026: Intrusion at AfD's party-owned hosting provider Alternita is detected and stopped, per people close to the provider; HIBP dates the breach to this day. ## Advisories - [AfD Data Breach](https://haveibeenpwned.com/breach/AfD) (Have I Been Pwned) ## Write-ups & news - [Attack on email hosting provider for German far right party AfD exposed 345k accounts](https://www.theregister.com/cyber-crime/2026/10/27/attack-on-email-hosting-provider-for-german-far-right-party-afd-exposed-345k-accounts/5305660) - [345,000 email addresses stolen in cyberattack on Germany's far-right party AfD](https://www.helpnetsecurity.com/2026/10/28/afd-data-breach-email-leak/) - [Zweimal gehackt: Wie 300 Gigabyte AfD-Daten abflossen](https://www.lilithwittmann.de/blog/afd-hack-2026/) ## Caveats The attack path (WordPress campaign site, WP-Console, mailbox password changes, IMAP bulk export) comes from the attackers and people close to the provider and has not been verified by AfD or authorities. AfD places the attack at the end of September, which conflicts with HIBP's and Wittmann's Sept 9 date. --- Machine-readable: https://pwn.watch/i/afd-alternita-email-hosting-breach-sep-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.