AfD confirms a September intrusion; an anonymous archive's claim of 421,179 emails remains unverified.
Why it matters: The incident raises questions about data-protection compliance and the cybersecurity of political organizations. Claims about racist, antisemitic, Nazi or violent content could carry political and legal consequences, but the archive has not been authenticated.
- The AfD said a hosting provider it used was hacked in September 2026.
- An anonymous archive claims to index 421,179 emails and roughly 281 gigabytes of data.
- Security Affairs reported that the archive displays summaries produced by unidentified software rather than original emails.
- Media reports said the Berlin data-protection authority received the AfD's notification at 18:59 on October 20, 2026.
The AfD said a hosting provider it used was hacked in September 2026 and that portions of several email accounts were copied without authorization. The party said most affected mailboxes had not been used for years and that current accounts of its federal organization were not affected. It described the incident as an attack on the party system and democracy in its official statement.
Tagesschau and ZDF separately reported the compromise involving AfD email accounts. That reporting does not authenticate the anonymous archive's claim that it contains 421,179 genuine messages. The archive itself is not linked in the materials provided.
Security Affairs reported the 421,179-email claim and the roughly 281-gigabyte figure. The same report described summaries produced by unidentified software, not AI-generated summaries, and did not establish that the archive contains the original messages.
Security Affairs also reported claims involving racist, antisemitic, Nazi and violent material, including material associated with Alice Weidel, Alexander Gauland and Tino Chrupalla. Those allegations have not been authenticated email-by-email. It remains unclear whether any statements were written by officials, forwarded, quoted for criticism, generated as spam or altered. Individual remarks would not automatically establish an AfD-wide position or criminal conduct.
Germany's General Data Protection Regulation, or GDPR, is the EU privacy regime governing personal-data processing. Under Article 33, a qualifying personal-data breach generally must be reported within 72 hours of the organization becoming aware of it, not automatically within 72 hours of the intrusion. The Berlin Commissioner for Data Protection and Freedom of Information provides related guidance. The materials identify September as the incident month but not the precise date the AfD discovered or was told about the breach. Media reporting, including the cited Tagesschau and ZDF coverage, put receipt of the party's notification at 18:59 on October 20. The materials do not identify a response from the unnamed hosting provider, the authority or the three individuals.
By the numbers
- 421,179 emails - claimed total in the anonymous archive, not independently authenticated
- 281 gigabytes - data volume reported by Security Affairs alongside the archive claim
- 72 hours - general GDPR reporting window after awareness of a qualifying breach
Yes, but: The AfD's statement and separate Tagesschau and ZDF reporting corroborate an intrusion involving email accounts, but they do not verify that the anonymous archive contains 421,179 authentic emails or substantiate its allegations about individuals.