Short answer
The AfD confirmed that a hosting provider of the party was hacked in September 2026 after about 421,000 emails were published online on 20 October. The party says most mailboxes were old and unused. Reporting by heise and Tagesspiegel's expert source disputes that the data is old.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Alternative fuer Deutschland (AfD) |
|---|---|
| Incident type | Data leak |
| Status | Confirmed by the organization |
| Sector | Political party |
| Country | Germany |
| Detected | 2026-09-09 |
| Disclosed | 2026-10-20 |
| People or records affected | About 421,000 emails from at least 10 mailboxes; Have I Been Pwned lists about 345,000 unique email addresses |
What data was exposed
- Around 420,000 emails from 10 mailboxes, including the party's federal headquarters and the Federal Arbitration Court
- More than 41,000 PDFs, 3,480 DOCX files and several SQL database dumps, per heise
- Reported ID card photo, invoices, bank statements, membership applications and membership lists from regional associations
What happened
Germany’s Alternative fuer Deutschland (AfD) confirmed a hack after an anonymous group published a trove of what it says are the party’s internal emails. The Local Germany reported on 21 October 2026 that about 421,000 alleged emails from at least 10 accounts had appeared online. Heise reported the day before that the dataset is about 280 GB, spread across 10 mailboxes that include the party’s federal headquarters and the Federal Arbitration Court.
An AfD spokesman said: “In September 2026, a hosting provider of our party was the target of a hacking attack.” The party says the mailboxes were mostly old and unused, and that it stopped the attack once it noticed.
What was published
Heise lists just over 41,000 PDFs, 3,480 DOCX files and several SQL database dumps alongside the emails. The Local reports, citing Bild and other outlets, an ID card photo of a deputy parliamentary group leader, invoices, bank statements, certificates, and membership applications and lists from district associations in North Rhine-Westphalia. The material sits on a searchable site with AI-generated summaries, and the originals were released through BitTorrent.
Those examples come from press reports of the leak, not from the party, and The Local stresses the documents must still be authenticated.
Disputed account
Heise notes that the party’s “old and unused” description conflicts with the data, which runs through early September and includes campaign communications for the Mecklenburg-Western Pomerania state election. Security researcher Mirko Ross told Tagesspiegel it is “by no means old data.” Heise quotes him as saying it looks like hacktivism rather than an insider job. The attackers say they got in through an “outdated website” and that their aim was not destruction.
Have I Been Pwned entry
Have I Been Pwned added the incident on 27 October 2026, listing about 345,400 unique email addresses with email messages as the data class. It is flagged sensitive, so only a verified owner of an address can see a match. Its entry says the party blamed a hosting provider, and later reporting identified it as Alternita Dienstleistungs GmbH, which the party owns.
What people connected to the leak should do
Anyone who emailed the party, or belongs to a local association, should expect that names, addresses and message contents may circulate. Be wary of unexpected messages that quote real details. Our data breach checklist covers password changes and monitoring, and the phishing messages guide explains how to check a suspicious email. If someone threatens to publish your messages unless you pay, see our guide to sextortion and blackmail scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails that use real names, subjects or membership details from the leak to look trustworthy.
- Blackmail or extortion messages that threaten to expose a person's emails or donations.
- Fake 'am I in the leak?' lookup sites that ask for your email address, ID or payment details.
What to do if you are affected
- 01If you wrote to or belong to the AfD, treat any message that quotes private details as possibly crafted from the leak.
- 02Change passwords on any account that shared a password with an AfD mailbox, and turn on two-factor authentication.
- 03Check your own address with the Have I Been Pwned notification service, which only shows results to verified owners.
- 04Do not pay or reply to anyone threatening to publish your messages, and report it to the police.
- 05Use only official channels from the party or your data protection authority for questions about your data.
Frequently asked questions
Did the AfD confirm the hack?
Yes. A party spokesman said a hosting provider of the party was the target of a hacking attack in September 2026. The party says the mailboxes involved were mostly old and unused.
How big is the leak?
The Local reports about 421,000 alleged internal emails from at least 10 accounts. Heise describes about 280 GB, with just over 41,000 PDFs, 3,480 DOCX files and several SQL dumps.
Is the data old, as the party says?
Disputed. Security expert Mirko Ross told Tagesspiegel it is clearly not old data, and heise reports the material runs through early September and includes campaign communications for a state election.
Are the leaked documents verified?
Not fully. The Local stresses the documents still need authentication, and the AI-generated summaries on the leak site are not the original emails. The group behind the site says many emails carry valid DKIM signatures.
Can I check whether my address is in it?
Have I Been Pwned added the incident on 27 October 2026 with about 345,400 unique addresses. It is marked sensitive, so only a verified owner of an address can see a match.
Sources
- What we know so far about the Alternative for Germany email leak, The Local Germany, 2026-10-21
- Massive AfD data breach exposes illegally copied files, heise online, 2026-10-20
- AfD data breach, Have I Been Pwned, 2026-10-27
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.