INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

AfD's Email Hosting Provider Compromised Exposing 345k User Accounts

| 2026-10-27 11:49 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A cyberattack on Alternative for Germany (AfD), the country's most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. The attack was first spotted on September 9 and started with a compromise of a poorly protected WordPress site, resulting in an extensive data breach where over a terabyte of data was exfiltrated from AfD-owned Alternita Dienstleistungs GmbH servers. The attackers gained persistent access to the servers and published various revelations, including party co-leader's opinions on colleagues' "deeply problematic" racial discourse. The current status is that the owners of the affected email accounts have been notified, and AfD reported the attack to security authorities, while also stating that it will not comment further on the veracity of the raw email files available for download via torrent.
Technical Mitigations AI-generated
• Patch WordPress sites with weak passwords and outdated plugins to prevent similar attacks. • Implement robust access controls, such as multi-factor authentication and least privilege access, for email hosting providers like Alternita Dienstleistungs GmbH. • Use more advanced AI-powered analysis techniques that consider context, rather than just keywords, when analyzing sensitive documents.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
DACH DACH
Incident Timeline
‎September 9
Threat actors compromised a poorly protected WordPress site on September 9, leading to the exposure of approximately 345k accounts.
‎2026/10/20
Threat actors used a phishing campaign to target the email hosting provider of the German far-right party AfD, resulting in the exposure of approximately 345k accounts.
‎October 20
“We are deeply concerned by what has happened,” the party said in an October 20 statement.
‎2026/10/27
Threat actors used a phishing campaign to target the email hosting provider of Germany's far-right party AfD, resulting in the exposure of approximately 345k accounts.
‎2026/10/27
Threat actors gained persistent access to the servers operated by Alternita Dienstleistungs GmbH, which hosts email accounts for the German far-right party AfD.
organisation AfD
The same report claimed the criminals gained persistent access to the servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data.
organisation Alternita Dienstleistungs GmbH
The same report claimed the criminals gained persistent access to the servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data.
organisation The Register
The Register contacted Alternita Dienstleistungs for its take.
Intelligence Sources
The Register - Cybercrime 2026-10-27