INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive

| 2026-10-20 10:53 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A data breach exposed 421,000 messages from Germany's Alternative für Deutschland (AfD) party in an anonymous online archive on hexane.cc. The hacking attack occurred in September 2026 when the AfD's hosting provider was compromised, with mailboxes copied and internal emails stolen. An AI-generated index of the emails has been published on hexane.cc, providing summaries grouped into categories such as racism and antisemitism, but the original texts remain unpublished. This breach raises questions about authenticity and privacy, particularly in ongoing court proceedings where the AfD is contesting its classification as a confirmed right-wing extremist organization by Germany's domestic intelligence agency.
Technical Mitigations AI-generated
• Patch the hosting provider's website to fix any unpatched vulnerabilities that could be exploited by hackers. • Regularly update and patch email servers to prevent similar breaches in the future. • Implement a robust security audit on all party websites, including those with sensitive information.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
DACH DACH
Incident Timeline
‎September 12, 2026
Threat actors gained access to AfD's mail servers through a single unpatched party website, exposing 421,000 messages in an anonymous online archive.
organisation Thuringia
Lawmakers in the Bundestag and Thuringia are separately debating whether to seek a formal party ban, which under German law can only come from the Federal Constitutional Court.
organisation the Federal Constitutional Court
Lawmakers in the Bundestag and Thuringia are separately debating whether to seek a formal party ban, which under German law can only come from the Federal Constitutional Court.
organisation CDU
Berlin-based security researcher Lilith Wittmann, who exposed a flaw in the CDU’s campaign app in 2021, wrote on X that she believed the leak was genuine and the reported attack method was plausible.
organisation the International Cyber Digest
The hacker reportedly told the International Cyber Digest account on X that they gained access through “a single unpatched party website” and then reached the mail servers.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, AfD)
‎September 2026
Threat actors used an unspecified hacking attack to compromise a hosting provider, resulting in the exposure of 421,179 AfD emails on hexane.cc.
organisation International Cyber Digest
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
organisation ICD
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
organisation Gauland
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
data_breach 12 September
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
‎October 19
Threat actors copied approximately 421,000 AfD email messages from a hacked hosting provider.
target_region Germany
Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied.
organisation AfD
Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied.
organisation the Cologne Administrative Court
The leak appeared on October 19, while the Cologne Administrative Court is actively weighing whether the intelligence agency may publicly apply the extremist designation, and two months before the AfD plans to seek the election of one of its leaders as state premier in Saxony-Anhalt.
‎19 October
International Cyber Digest reported on 19 October that an anonymous online archive exposed approximately 421,000 AfD emails, including Gauland's mailbox, with the newest message dated 12 September 2026.
organisation International Cyber Digest
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
organisation ICD
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
organisation Gauland
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
data_breach 12 September
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
‎2026/10/20
An anonymous online archive, hexane.cc, published an index of 421,179 internal AfD party emails after a data breach exposed the emails.
organisation AfD Email Breach Exposes
AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive.
Tactical Metrics
Metrics
data_breach
12
September
International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026.
Intelligence Sources
Security Affairs 2026-10-20