Alternative for Germany confirms hack after 421,000 emails leaked online

The reported incident involved a hosting provider used by the AfD. The party said hackers illegally copied parts of several email accounts in September 2026. The authenticity of the published material has not been independently confirmed. Unknown individuals claim to have released about 421,000 emails online.

The AfD said the affected data came from ten mailboxes. These included an account in former party leader Alexander Gauland’s name and an account once listed as a federal headquarters contact. The party said most affected accounts had not been used for years. Bild reported that AI-generated email summaries and sensitive files were already online.

The AfD said it detected and stopped the attack quickly. It is reviewing whether the published material came from the stolen data. The party also said current email accounts belonging to its federal association were not affected, though the exposure could still bring public and legal scrutiny.

The alleged scale is approximately 421,000 emails linked to AfD members. That figure comes from the people who published the material, and the emails’ authenticity has not yet been confirmed. The size matters because a large archive can reveal years of communication, relationships, and organizational activity.

The AfD said the stolen material originated in ten mailboxes. One was in Alexander Gauland’s name, while another had previously been used as a federal headquarters contact. Reports also described identity-card photographs, other identification documents, invoices, bank statements, certificates, membership applications, and membership lists from district associations in North Rhine-Westphalia.

The party said most affected accounts had not been used for years and that current federal accounts were not affected. Even so, the alleged volume and document variety make verification difficult and raise concerns about privacy, security, and possible misuse if the files are genuine.

A hosting provider is a company that runs internet-connected computer systems for organizations. Those systems may include websites, databases, and email services. A mail server is the part that receives, stores, and sends messages. The article says the reported attack targeted an AfD hosting provider, but it does not explain the precise technical weakness.

In general, attackers can exploit stolen passwords, weak access controls, unpatched software, or a compromised administrator account. Once inside, they may search mailboxes and download messages, attachments, address books, or stored documents. They could copy data quietly before anyone notices. The AfD said parts of several accounts were apparently illegally copied.

The party said the attack was detected and stopped quickly. However, stopping access does not automatically erase copies already taken. Investigators would need to determine how the attackers entered, which accounts were accessed, what was copied, and whether the material published online is authentic.

A genuine leak could harm both the AfD and individual members. For the party, private correspondence might expose internal disagreements, sensitive contacts, or administrative weaknesses. That could increase political pressure and create reputational damage. The article specifically says public exposure could leave the party vulnerable to intensified public and legal scrutiny.

For individuals, identity-card images, bank statements, invoices, and certificates can reveal personal information. In general, criminals could use such information for impersonation, targeted scams, harassment, or other privacy violations. Membership applications and lists could also expose people’s political affiliations. The article does not report that any of these harms have already occurred.

The immediate reality is uncertainty. The email material has not been authenticated, and the AfD is reviewing the online publication. The party said current federal accounts were unaffected, but older accounts and stored files may still require investigation, notification, and protective action if the data proves genuine.

The leaked messages could attract unusual attention because the article describes a party already facing scrutiny. Germany’s domestic intelligence agency has classified several AfD state chapters as “confirmed right-wing extremist.” The article also says senior party figures have well-documented ties to extremist and neo-Nazi networks. Those facts make internal communications especially relevant to journalists, investigators, and the public.

If authentic, messages could be examined for evidence about contacts, organizational decisions, or relationships with extremist networks. They might also be compared with public statements. That does not mean every email would show illegal conduct or prove a connection. The article does not report confirmed wrongdoing revealed by the leak.

The present situation remains unresolved. The emails’ authenticity has not been confirmed, while the AfD says it is reviewing the publication. Because the files may include private and sensitive material, scrutiny could involve both public debate and legal questions about privacy, unauthorized access, and the use of published information.

Publishing files is only one possible use of stolen political data. Attackers may threaten to release selected emails unless money is paid, sell access to interested groups, or use personal details for targeted fraud and intimidation. They may also release documents gradually to shape public attention. These are general possibilities; the article does not establish that they happened in the AfD case.

The article gives a concrete comparison from Berlin. Hackers reportedly obtained 1.4 million files from the Senate Department and demanded 30 bitcoins, described as more than two million euros. After authorities refused to pay, the files were said to have been published on the dark web.

The AfD said its attack was detected and stopped, and it is reviewing material already posted online. That means the next questions concern authenticity, the full scope of the copied data, and whether anyone seeks money or uses the files elsewhere. Publication can continue even after the original access is blocked.

Email systems need layered protection because one stolen password can expose many messages. Strong authentication, especially multi-factor authentication, makes account takeover harder. Access controls should give each person only the permissions needed for their work. Organizations should also remove inactive accounts and review administrator privileges regularly.

Encryption protects messages while they travel and, where supported, while they are stored. Secure, offline or otherwise isolated backups help restore systems after an attack, while software updates close known weaknesses. Logging and monitoring can reveal unusual downloads, new forwarding rules, or access from unexpected locations. Staff training can reduce successful phishing attempts.

These are general cybersecurity measures, not protections the article confirms the AfD used. The party said its attack was detected and stopped quickly, but the alleged copying shows why detection alone is insufficient. Political organizations also need tested response plans, evidence preservation, and clear procedures for notifying affected people if sensitive records are exposed.