AfD: hosting provider breached, 421,000 emails in online archive

The German party Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider it uses was breached in September and that some mailboxes were copied. Within the same hours, the anonymous site hexane.cc published the index of what it claims is an archive of 421,179 internal emails. According to Graham Cluley, the full material, 281 GB of messages and more than 100,000 files, can be downloaded via torrent.

What happened

• September 2026: according to the party, the hosting provider was attacked and parts of some mailboxes were copied. The most recent message in the index is dated 12 September 2026, according to the analysis by the International Cyber Digest (ICD) account reported by Security Affairs and Cluley.
• 19 October: hexane.cc goes online and the party confirms the incident to the newspaper Bild. In the afternoon, the site’s pages explaining its method and purpose return server errors (Security Affairs).
• 23 October: heise Security reports a claim of responsibility by the presumed perpetrators. According to Cluley, whoever leaked the data says they want to expose the party’s “degeneracy and hypocrisy” and claims to have received, from a Proton Mail address, an offer of 100,000 euros to take the site down.

The party’s account is limited: the attackers allegedly copied parts of a few mailboxes, mostly unused for years, without accessing the leadership’s current accounts. The dates of the messages in the index, up to 12 September, cast doubt on this account, as both Security Affairs and Cluley point out.

Technical details

No CVEs or affected software have been disclosed. What is known:

• Initial access: the attacker told ICD they got in through “a single unpatched party website” and reached the mail servers from there. The party only confirms the attack on the hosting provider; the entry method has not been independently verified. If confirmed, it would be exploitation of a public-facing application (MITRE ATT&CK T1190) followed by a move to the mail systems on the same infrastructure.
• Collection and staging: file names in the archive point to a server labelled “afd_exfil”, a label commonly used for the system where data is gathered before being moved out of the network (email collection T1114, data staged T1074).
• Publication: hexane.cc does not show the emails but summaries written by AI software, sorted into categories such as racism and antisemitism and graded from Low to Critical; the software used is not named. According to Security Affairs (20 October), opening a record displays “source text not published for this record”, and no summary had been linked to a verifiable original. According to Cluley (23 October), the site points to the torrent for the complete originals, with headers, bodies, attachments and DKIM signatures.
• Reliability: party sources quoted by Cluley consider the emails authentic but report several inaccuracies in the summaries. Bild, the only German outlet known to have examined a small sample directly, found identity documents, invoices, bank statements, membership applications and regional member lists with names and home addresses, even though the site claims to have minimised personal data.

The DKIM signatures are the most relevant detail for verification: they make it possible to check that a message has not been altered, as long as the sending domain’s public key is available. An AI-generated summary, on the other hand, cannot be verified.

Cluley also recalls an earlier episode: on 3 September, the press spokesman of the AfD group in the Thuringia state parliament warned that his work mailbox had been used to send phishing emails with PDF attachments. No source links it to the hosting breach.

Impact for European and Italian companies

The victim is a party, but the pattern applies to many organisations: a forgotten or unpatched website on the same infrastructure as email, no separation between the two, mailboxes inactive for years still full of correspondence and attachments.

Under the GDPR, membership applications and member lists of a party reveal political opinions, a special category of data (Article 9); the same applies to trade unions, associations and religious organisations. A leak of this kind poses a high risk to individuals and generally requires both notification to the supervisory authority and communication to the data subjects.

The stated entry point is a hosting provider: for NIS2 entities (in Italy, Legislative Decree 138/2024) supply chain security is one of the required measures, and managed service, cloud and data centre providers may themselves fall under the directive.

Finally, there is a risk for the curious: Cluley advises against downloading the torrent, because torrents tied to trending news have been used to spread malware in the past, and because handling stolen personal data can have legal consequences.

What to do now

1. Inventory your exposed websites, including local, campaign and discontinued project sites: update them or shut them down.
2. Separate web from email: different servers, admin accounts and credentials; a compromised website must not give access to mailboxes.
3. Manage inactive mailboxes: disable unused accounts, apply a retention policy, archive offline or delete mail that is no longer needed.
4. Watch for exports: bulk IMAP downloads, mailbox exports, large outbound transfers from mail servers, admin logins from new origins.
5. Review hosting contracts: incident notification times, log access, segmentation between customers.
6. Forbid downloading leaked archives on company devices and block torrent clients where they are not needed.
7. Prepare your response: risk assessment for data subjects and notification to the authority within 72 hours, with particular attention to special category data.

How ARXDOME helps

ARX Expose shows what an attacker sees from the outside, including vulnerable exposed services and company accounts involved in known breaches: it helps you find the forgotten website before someone else does. ARX Shield reports open vulnerabilities on monitored machines, and ARX Sentry collects logs and events from servers and firewalls, useful for spotting anomalous access and transfers.

Last updated: 23 October 2026