345,000 email addresses stolen in cyberattack on Germany’s far-right party AfD

Over 345,000 unique email addresses were exposed in the September 2026 breach at German far-right political party Alternative für Deutschland (AfD).

Breach notification service Have I Been Pwned (HIBP) added the data to its database on 27 October, listing email addresses and email messages as the compromised information.

HIBP has flagged the incident as a sensitive breach, so the data cannot be searched publicly. Only the verified owner of an email address can check whether it appears in the breach, by signing in to the HIBP dashboard, while organizations can search the domains they control.

Once a fringe party, AfD has grown into one of the largest political forces in Germany, with immigration driving much of its support since the 2015 refugee crisis.

Its rise has drawn scrutiny over the party’s views on Germany’s Nazi past, and in May 2025 the domestic intelligence service classified it as a confirmed right-wing extremist organization, a designation a Cologne court provisionally suspended in February.

The breach comes as the party leads national opinion polls, having won state elections in Saxony-Anhalt and Mecklenburg-Western Pomerania last month, where Chancellor Friedrich Merz’s centre-right Christian Democratic Union (CDU) suffered heavy losses.

The party’s response

AfD confirmed in a statement on 20 October that the stolen data had been made accessible through “an activist website,” with the scale of the attack becoming apparent the day before.

“Although only a few mailboxes were unlawfully copied, large amounts of data were leaked,” the statement reads. It added that it had “immediately informed the owners of the mailboxes at the time, as well as the data protection commissioner.”

That second claim is disputed by investigative journalist Lilith Wittmann. In an update to her reporting on the breach, she noted that the Berlin data protection commissioner received the party’s breach notification on the evening of 20 October, about two hours after the press release went out.

AfD called the attack illegal and “an attack on the German party system and therefore on democracy.” It voiced concern that the stolen documents appear to have been analyzed with “a very rudimentary AI” that looked at keywords and ignored context, and said “the alleged scandals published so far do not stand up to scrutiny.”

Der Spiegel and ZDF, which went through the emails, reported that AfD co-leader Alice Weidel appears to have known about planned donations tied to her 2017 federal election campaign about two months earlier than she has publicly claimed.

Two break-ins in one week

Wittmann, who spoke with the hackers and with people close to the company running the party’s IT infrastructure, reported that the attackers got in through a poorly secured WordPress site at wahlkampf.afd.de. From there they reached the mail management system, changed the email passwords of party officials and started pulling data off the servers.

The intrusion was noticed on 9 September and stopped, but the hackers told Wittmann that malicious code they had left behind went undetected. They used it to return on 14 September and copy more data before being discovered a second time. The stolen files were later offered for download via a torrent link.

The company in question is Alternita Dienstleistungs GmbH, a party-owned firm that provides web hosting, accounting and other services to AfD branches and manages hundreds of domains for the party.

AfD’s own account places the attack at the end of September. Wittmann wrote that this “contradicts both the available data and the statements of the hackers and of employees of AfD service providers.”

The hackers’ account of how the attack unfolded has not been confirmed by AfD or the authorities.

Voter data caught in the leak

The people affected go beyond party officials. Wittmann found that the emails hold excerpts from member databases of several state branches, along with data AfD requested from population registers for campaign purposes. These include records on young people in Mecklenburg-Western Pomerania who were voting for the first time this year.

“The data was sent by the registration offices unencrypted by email,” she wrote.

German law allows parties to receive such registry data for election advertising, but it has to be deleted within a month of the election.

AfD said all affected users were informed. “It is uncertain, however, whether the numerous people whose data is contained in the leaked emails were informed as well, without themselves being users of the affected systems,” Wittmann argued in her report. Under Article 34 of the GDPR, people generally have to be notified of a data breach likely to result in a high risk to their rights and freedoms.

The hackers told her they regret publishing data belonging to uninvolved third parties, saying it was never their goal.