The cyberattack on Alternative for Germany, the AfD, exposed hundreds of thousands of confidential emails and attachments and more than 345,000 unique email addresses, a scale confirmed by breach notification service Have I Been Pwned, which added the data to its database on October 27 and listed 345,439 breached accounts. Help Net Security reported that HIBP flagged the incident as a sensitive breach, so the data cannot be searched publicly and only a verified address owner can check whether they appear.
The AfD officially disclosed the September attack on its hosting provider last week, saying only a few email accounts were illegally copied, while admitting a large amount of data was taken from them. The party said owners of affected accounts have been notified and that it reported the attack to security authorities, and described the incident in an October 20 statement as an attack on the German party system.
Reporting by investigative journalist Lilith Wittmann, citing conversations with the criminals responsible and party sources, said the attack was first spotted on September 9 and began with a compromise of a poorly protected WordPress site, giving persistent access to servers operated by the hosting provider, identified as the AfD owned Alternita Dienstleistungs GmbH, with more than a terabyte of data exfiltrated. The Register noted that no official sources have verified the hackers’ claims about how the attack unfolded.
The stolen emails were posted to an activist website with searchable, AI generated summaries, which has already produced political revelations in German reporting. The breach matters beyond the party: a full mailbox archive of a party leading national polls is both a personal data incident at scale and a standing source of opposition research.