Attack on AfD email host exposes 345,000 accounts, party says AI used to analyse stolen data

German far-right party confirms breach of its hosting provider, with leaked emails posted on activist website

By LineZotpaper AI staff

Published27 October 2026

Read Time2 min

Illustration: Attack on AfD email host exposes 345,000 accounts, party says AI used to analyse stolen data

A cyberattack on the email hosting provider of Germany's far-right Alternative for Germany (AfD) party exposed more than 345,000 unique email addresses and a large volume of confidential emails and attachments, Have I Been Pwned confirmed. The party disclosed the September attack on its own hosting provider, Alternita Dienstleistungs GmbH, last week and said it is 'deeply concerned', describing the incident as an illegal attack on democracy.

The breach, first spotted on September 9 according to an investigative report by Lilith Wittmann, began with the compromise of a poorly protected WordPress site, the report claimed. Wittmann, citing conversations with the cybercriminals and party sources, said the attackers gained persistent access to the hosting provider's servers and exfiltrated more than a terabyte of data. These claims have not been verified by official sources.

AfD acknowledged in a statement on October 20 that 'only a few email accounts were illegally copied' but admitted a large amount of data was taken, leading to an extensive breach. The stolen emails were published on what the party called 'an activist website', which used artificial intelligence to summarise them into searchable topics. AfD expressed alarm that the content was analysed with 'a very rudimentary AI' focused on keywords rather than context, arguing the resulting summaries do not withstand scrutiny.

Among the topics highlighted by the site are chains purportedly involving Holocaust denial, racist and antisemitic remarks, 9/11 references, and forged documents. German magazine Der Spiegel reviewed the raw files and reported that party leader Alice Weidel appeared to have known about illegal donations related to the 2017 federal elections weeks earlier than she previously stated. AfD has not specifically commented on the veracity of the raw email files posted via torrent, and has told reporters it will not comment on whether the emails or stories based on them are trustworthy.

The party said it has notified affected email account owners and reported the attack to security authorities.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

The breach exposes sensitive internal communications of a major European political party, potentially influencing public discourse and electoral dynamics.
It highlights cybersecurity vulnerabilities in political organisations, particularly those using self-hosted infrastructure.
The use of AI to analyse leaked data raises new questions about privacy, context, and the reliability of automated summaries in public controversies.

Background

AfD is Germany's most prominent far-right political party, currently under scrutiny for its positions on immigration, national identity, and historical issues. The attack targeted Alternita Dienstleistungs GmbH, a hosting provider owned by the party. The breach was disclosed nearly a month after it was first detected, and the leaked emails have since been made searchable on an activist-operated website.

Key Perspectives

Alternative for Germany (AfD): describes the cyberattack as an illegal criminal offense and an attack on the German party system and democracy. It says the AI-generated summaries of the emails are taken out of context and do not stand up to scrutiny, a view it says is being confirmed by commentators on social media.
Investigative report by Lilith Wittmann: (based on conversations with the hackers and party sources) claims the attack started with a poorly protected WordPress site and resulted in persistent access and the exfiltration of over a terabyte of data. These details have not been officially confirmed.

What to Watch

Whether German authorities verify the hackers' account of the breach and pursue charges.
The possibility of further revelations from the leaked emails and the impact on AfD's leadership and electoral standing.
Debate over the reliability of AI-generated summaries in the context of leaked materials and their use by activist platforms.

Sources

Attack on email hosting provider for German far right party AfD exposed 345k accounts · The Register

Checked

12 claims in this story checked against 1 source: 11 supported.

Show each claim

Partly supportedThe attack exposed 345,000 accounts.www.theregister.com - Articles: “more than 345,000 unique email addresses”
SupportedAfD said the stolen documents were analysed using AI.www.theregister.com - Articles: “the content of the stolen documents was analyzed using a very rudimentary AI.”
SupportedAfD confirmed a breach of its hosting provider.www.theregister.com - Articles: “after AfD officially disclosed the September attack on its hosting provider last week.”
SupportedLeaked emails were posted on an activist website.www.theregister.com - Articles: “The emails were added to what the party described as “an activist website,””
SupportedHave I Been Pwned confirmed that more than 345,000 unique email addresses were exposed, along with confidential emails and attachments.www.theregister.com - Articles: “exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. Have I Been Pwned confirmed the scale of the breach”
SupportedAfD disclosed the September attack on its hosting provider last week.www.theregister.com - Articles: “AfD officially disclosed the September attack on its hosting provider last week.”
SupportedAfD said it was deeply concerned and described the attack as illegal and an attack on democracy.www.theregister.com - Articles: ““We are deeply concerned by what has happened,” the party said in an October 20 statement. “Such a digital attack is illegal and a criminal offense. Furthermore, it is an attack on the German party system and thus on democracy.”
SupportedWittmann’s report said the attack was first spotted on September 9.www.theregister.com - Articles: “the attack was first spotted on September 9”
SupportedWittmann’s report said the attack began with the compromise of a poorly protected WordPress site.www.theregister.com - Articles: “started with a compromise of a poorly protected WordPress site.”
SupportedWittmann’s report claimed the attackers gained persistent access to the hosting provider’s servers.www.theregister.com - Articles: “The same report claimed the criminals gained persistent access to the servers operated by the hosting provider”
SupportedWittmann’s report claimed more than a terabyte of data was exfiltrated.www.theregister.com - Articles: “exfiltrated more than a terabyte of data.”
SupportedOfficial sources have not verified the claims about how the attack unfolded.www.theregister.com - Articles: “No official sources have verified the hackers’ claims about how the attack unfolded.”