Unidentified individuals have published more than 420,000 internal emails purportedly belonging to Alternative for Germany (AfD) politicians and offices, following a breach at an external IT service provider.
According to information accompanying the leaked repository, the affected material, some 281 gigabytes, stems from roughly ten party inboxes. Bild put the number of messages at 421,179.
These include an account under the name of former party co-leader and current honorary chairman Alexander Gauland, as well as a general contact address previously used by the AfD federal headquarters. German outlets reporting on the archive have also listed accounts in the names of party co-leader Alice Weidel, deputy leader Beatrix von Storch, former co-leader Jörg Meuthen and Bundestag member Leif-Erik Holm.
A spokesperson for the AfD confirmed that a cyberattack took place in September against an external hosting provider used by the party.
During this incident, parts of a few email inboxes were copied unlawfully, the spokesperson told Die Zeit, adding that most of the targeted addresses had not been used for years and that active accounts belonging to the current federal executive board were not affected.
The material on the site is dated from 2014 through to September 2026, which sits awkwardly with the party’s account of dormant mailboxes.
Bild newspaper said it was able to view a small part of the material. Among them was a photo of the identity card of the deputy AfD parliamentary group chairman Markus Frohnmaier as well as other identification documents, bank statements, invoices and certificates.
Membership applications and membership lists of AfD district associations in North Rhine-Westphalia, western Germany, are also said to be among the captured documents.
No spectacular scandals were unearthed in the first day of reporting on the archive, though the site’s operators claim otherwise. They say an automated summary of some 39,000 messages rated 611 of them as “critical” and a further 10,450 as pointing to serious misconduct. Those ratings have not been independently verified.
The party stated that the breach was detected and halted quickly at the time, with affected users notified following the intrusion.
Party officials and cybersecurity specialists are currently reviewing the leaked dataset to verify the authenticity of the material and assess whether manipulated or fabricated files have been inserted into the archive.
Lilith Wittmann, a German security researcher known for exposing data protection failures in party-run systems, said on X that on the basis of what she had seen so far she considered the material genuine, and that the way access had been obtained was traceable.
It is unknown who is behind the attack.
The website publishing the files seems to be AI generated, as do the partially translated (from German to English) files. Visitors to the site are met with a phishing warning.
Another cyber intrusion was already reported by the AfD parliamentary group in the Thuringian state parliament on September 3. Unidentified individuals took over the account of the group’s press spokesman Hans-Jörg Jenewein and sent phishing emails from it, with recipients warned not to open PDF attachments.
Der AfD-Hack – was bisher bekannt ist
Am 19. Oktober ging eine anonyme Archivseite online. Sie behauptet, über 421.179 E-Mails, rund 281 Gigabyte zum Herunterladen sowie interne Dokumente und komplette Postfachbestände zu verfügen.
Die Daten seien auf der Webseite… pic.twitter.com/TC8ioVwhN3
— GFrei.News (@GFreiNews) October 20, 2026
