AfD Email Accounts Breached: Party Confirms Attack, Attackers Publish Claimed Emails

Wed Oct 28

October 19–20, 2026: the German party Alternative für Deutschland (AfD) confirmed a hacking attack on its email accounts, which it said took place in September 2026 on a hosting provider the party uses. The party says only parts of a few mailboxes were copied. Attackers have published material they describe as about 421,000 emails from ten mailboxes. The party has not verified that figure. Canonical: afd-email-accounts2026. Primary reporting: Euronews.

This entry records a data breach affecting the email accounts of a political party. The published material is the attackers’ selection. Reporting has not established how complete it is or how authentic each message is, so no single message should be treated as confirmed. BreachHistory does not link to or reproduce the material. An earlier incident, in 2016, exposed the names of about 2,100 congress attendees; see the 2016 entry.

What happened

September 2026: according to the party, the attack hit a hosting provider it uses. The exact date has not been disclosed.
October 19: publication of the material began, according to reporting. CORRECTIV’s review dates the documents to September 2026.
October 19–20: the party confirmed the attack and said it was investigating the publication.

Verified and unverified

Party statement: a hacking attack on email accounts took place. Parts of a few mailboxes were copied, most of them unused for years. Current federal party mailboxes were not affected. The party gave no exact account count and did not say when it discovered the breach.
Unverified (attackers): about 421,000 emails from ten mailboxes, plus documents and attachments. Authenticity has not been independently verified.
Researcher view (as reported): a security researcher quoted in reporting considers the leak likely genuine and the reported method plausible.

Why it matters

Email from a party’s staff, members and supporters can contain private addresses and personal details that were never meant for publication. People named in leaked messages may have written only part of a thread, and a message is not proof of anything beyond what it says on its face.

What to do

Do not download or redistribute the material. Reporting notes possible legal consequences for sharing it in Germany, and says whether downloading alone is punishable is disputed.
If you corresponded with the party by email, assume your address could appear in leaked messages. Watch for phishing that quotes real correspondence, and verify requests through a known channel.
Turn on multi-factor authentication for any email account used with the party, and remove old mailboxes you no longer use.
Journalists and researchers should verify material with the party or independent experts before publishing any claim drawn from it.

Reference links

Sourcing note: the party’s account comes from its statement as reported by ORF. The 421,000 figure is the attackers’ claim, reported by several outlets, and is not used as a record count in the catalog.