Zero Radar
← feed
MediumData breachHIBP-AfDupdated 27 Oct 2026, 07:28 UTC

AfD political party email data leaked online after hosting-provider attack

Hackers got into a system used by the German AfD party and stole emails and attachments, which were then published online for anyone to search or download. People who wrote to the party may have had their email addresses and message content

Official source
SeverityMediumData breach
Being exploited?UnclearNo reports either way yet
What to doCheck exposureAssume any correspondence you sent to AfD may be public and watch for targeted phishing using it.
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Intruder gains accessBreach detected 9 September 2026
  2. 2Hosting provider hitAlternita Dienstleistungs GmbH systems compromised
  3. 3Emails stolenAbout 345k addresses and hundreds of thousands of messages
  4. 4Data published onlineFollowing month, searchable and downloadable
  5. ResultPrivate party emails become publicly accessible

What happened

A breach at the German AfD party, traced to an attack on its hosting provider Alternita Dienstleistungs GmbH, exposed about 345k unique email addresses and hundreds of thousands of emails and attachments, later published online with AI-generated searchable summaries.

Why it is dangerous: Anyone whose address or messages were exposed can be targeted with phishing, spam, or harassment, and the private content of their correspondence is now public.

Are you affected?

You are affected if your email address or messages were sent to or from AfD-related accounts hosted with Alternita Dienstleistungs GmbH.

Package / productAffected versionsFixed in
afd.desee advisoryno fix yet

What to do

  1. Check whether your email address appears in Have I Been Pwned and watch for phishing that references AfD correspondence.
  2. Change passwords for any accounts that reused an address or password involved in AfD communications.
  3. Be cautious with unsolicited emails or calls that cite your past contact with the party.

Timeline

  1. 27 Oct 2026, 07:01 UTC
    Publicly disclosed
  2. 27 Oct 2026, 07:01 UTC
    Reported by Have I Been Pwned · Have I Been Pwned
  3. 27 Oct 2026, 07:28 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

  • AfDHave I Been Pwned · 27 Oct 2026, 07:01 UTC

Technical details

ID
HIBP-AfD
Disclosed
27 Oct 2026, 07:01 UTC
On Zero Radar
27 Oct 2026, 07:28 UTC (27 min after disclosure)
Last change
27 Oct 2026, 07:28 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AfD political party email data leaked online after hosting-provider attack · Zero Radar