AfD Emails Hacked: Security Expert Suspects “Hacktivism” Behind AfD Leaks

After a hacker attack on email accounts of AfD politicians became known, there are different assessments of how serious the incident is. A spokesman for the AfD told the F.A.Z. on request that there had been a hacker attack on a hosting service provider of the party in September 2026. It appears that parts of a few mailboxes – most of which had not been used for years – were illegally copied. Previously, the “image” had reported. Current e-mail inboxes of the AfD-Bundesverband were not affected. Unknown published data on the Internet, which is said to be about 421,000 AfD e-mails. Whether these are real or not is unclear. The hackers claim that it is data from ten mailboxes, including an account in the name of former AfD party leader Alexander Gauland and an account that was formerly named by the AfD as a contact for the Federal office. Fresh data can also be found On the Internet, the link to a website called “hexane.cc” circulates, on which an overview of the alleged AfD mails is shown. According to dpa research, the anonymous site was not registered until mid-October. It does not provide any information about the origin of the data and does not publish any mail content. These are on another download server. These are very large amounts of data. However, experts have already expressed the opinion that the data could be authentic. Cybersecurity expert Mirko Ross told the F.A.Z. on Tuesday that he had already analyzed some of the data. However, what can be found there goes far beyond what the AfD has so far publicly described as affected by the hack. There are also emails from 2026. As outdated as the AfD represents the hacked data, they are not. The “how the data is processed” suggests that the person or those who put it online is part of the “spectrum hacktivism”. This means hackers who work politically activists. The data set is prepared in such a way that users can work quickly with it. Ross, who used to be a hacker himself, now runs a cybersecurity company and works as a security consultant for public bodies. He suspects that with the leak the AfD should be discredited. From whom, be open. It could have been an attack from the outside, but it is also possible that someone who had or has access to the IT infrastructure of the AfD wanted to harm the party. Data from NRW are disproportionately common in the material that Ross sighted, according to his data. In NRW, a violent conflict is raging within the AfD state association. In the social networks, users described various finds that they had made in the data material. These include agendas for meetings, membership lists, financial data, strategy papers, but also emails with allegations against party friends; So is complained about an AfD politician, who has expelled swastika flags at the information stand in Bottrop, or claims that a photographer was lured to an event to threaten him there. The AfD further stated that the attack was quickly recognized and ended. All users were informed accordingly. “The online publication that has now taken place presumably part of this data will be reviewed,” it said. An initial assessment of this can only be given after the completion of this examination.