The attack and the party's account

The Alternative for Germany (AfD) confirms that a hacker attack took place in September 2026 against a hosting provider the party uses. The party told Die Zeit and Bild that parts of a few mailboxes were illegally copied, and that most of those accounts had not been used for years. In a statement sent on request, the party described the incident this way:

“In September 2026 there was a hacker attack on a hosting provider of our party, in which parts of a few mailboxes, most unused for years, were copied.”

According to the party, the current email mailboxes of its federal organisation were not affected. The attack was detected and stopped within a short time, and everyone whose account was targeted has been informed.

What appeared online

Unknown people say they have published more than 421,000 AfD emails on the internet, according to Die Welt, while Süddeutsche Zeitung gives a figure of about 420,000. Bild first reported the figure of about 421,000. The authors reportedly claim the messages come from ten mailboxes, including one in the name of former AfD party leader Alexander Gauland and another address the party once listed as the contact for its federal office.

Spiegel reports that emails said to come from party leader Alice Weidel were among the material, although her own account was apparently not hacked. RP Online names correspondence from Weidel, Gauland and Leif-Erik Holm, and says an identity document of Markus Frohnmaier, deputy leader of the AfD parliamentary group in the Bundestag, was also published. Telegraaf reports that the website published AI-generated summaries of the emails rather than the emails themselves.

Bild, which saw some of the material, describes photographs of identity documents, invoices, bank statements, diplomas, membership applications and membership lists of AfD branches in North Rhine-Westphalia.

Authenticity and the review

Whether the published material is genuine remains unclear, and it is not yet established whether all of it came from the September attack. The party says the online publication of presumably part of the data is now under review:

“The online publication of presumably part of this data is being examined, and a first assessment can only be given once that review is complete.”

The exact circumstances of the attack and the scale of the leak have not been established. Until the incident is clarified, the authenticity and origin of all published data remain uncertain.

Wider concerns

Mediafax frames the case as a reminder of the cybersecurity risks facing political parties, particularly with regard to email accounts and internal information. The party's account of older, rarely used mailboxes is the main point of its defence so far, while the published summaries and documents are the main point of concern for those named in them. Alexander Gauland and Alice Weidel are named in the reports as senders or account holders, but the reports do not establish that any of the published messages are authentic.