AfD hosting provider Alternita breach: Hexane.cc leaks emails, HIBP counts 345k addresses, over 1 TB reportedly stolen
Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 28/10/2026 00:07; os links antigos trazem para cá.
Fontes: theregister.com ↗ haveibeenpwned.com ↗ bitdefender.com ↗ securityaffairs.com ↗
Germany's Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider it uses was hacked in September 2026 and that mailboxes were copied (securityaffairs.com, bitdefender.com). Later reporting identifies the provider as the party-owned Alternita Dienstleistungs GmbH (haveibeenpwned.com, theregister.com). An anonymous actor runs the leak site Hexane.cc, which claims to index 421,179 internal emails. The actor published a 281 GB corpus with more than 100,000 files via a torrent linked from the site (bitdefender.com). On 27 October 2026 Have I Been Pwned added the data, counting 345.4k unique email addresses, and flagged it as sensitive so it is not publicly searchable (haveibeenpwned.com). The Register reports that more than a terabyte was exfiltrated, according to the attackers' account relayed by Lilith Wittmann (theregister.com). The AfD says only a few, mostly dormant accounts were copied, but the archive reportedly includes messages dated as late as 12 September 2026, and the party admits a large volume of data was taken (theregister.com). Bild reviewed a small sample that appeared genuine, including identity documents, invoices, bank statements, membership applications and member lists (securityaffairs.com). Der Spiegel and others have used the leak for reporting, including on party leader Alice Weidel and illegal donations linked to the 2017 federal elections (theregister.com). The leak is politically sensitive because of pending court proceedings over the party's extremist classification and debates on a possible ban.
Detalhes técnicos
- Initial access: the actor reportedly told International Cyber Digest they entered through "a single unpatched party website" and then reached the mail servers (securityaffairs.com). Bitdefender also reports a website allegedly left unpatched. Per Lilith Wittmann, citing the attackers and party sources, the intrusion began with the compromise of a poorly protected WordPress site, and the attackers gained persistent access to servers operated by the AfD-owned hosting provider (theregister.com). No official source has verified these accounts; The Register has contacted Alternita for comment (theregister.com). The hosting provider's shared infrastructure may also not have been properly segmented (bitdefender.com).
- Timing: an analysis cited by HIBP says the breach was detected as early as 9 September, with a subsequent intrusion five days later (haveibeenpwned.com). The Register likewise says the intrusion was first spotted on 9 September (theregister.com).
- AfD's public statement attributes the breach to a compromise of a third-party hosting provider, with no further technical specifics (haveibeenpwned.com). No CVEs or IOCs are stated.
- One server in the archive is labeled "afd_exfil", which suggests a data-staging system (securityaffairs.com).
- The index reportedly includes the mailbox of Alexander Gauland (securityaffairs.com).
- Hexane.cc does not publish emails directly. It shows AI-generated summaries sorted by topic (e.g. racism, antisemitism) with severity ratings from Low to Critical. Full originals, including headers, bodies, attachments and DKIM signatures, are available only via torrent (bitdefender.com). The AI software used is not named, and summaries are not linked to verifiable originals; pages show "source text not published for this record" (securityaffairs.com).
- Exposed data include full names and home addresses of ordinary members, identity documents (including that of Markus Frohnmaier), and financial records (securityaffairs.com). HIBP lists 345.4k unique email addresses, with emails and attachments in the wider leak (haveibeenpwned.com).
- Wittmann considers the leak genuine and the attack method plausible (securityaffairs.com). Party sources say the emails appear authentic but the AI summaries contain several inaccuracies (bitdefender.com).
- On 19 October the site's About, Method and Support pages were returning server errors (securityaffairs.com).
- Motive and claims: the hacker says the leak aims to expose the party's "degeneracy and hypocrisy" and claims someone with a Proton Mail address offered 100,000 euros to take the site down (bitdefender.com). This is unverified.
- Possibly related: on 3 September a press spokesman for the AfD group in the Thuringia state parliament warned that his work email account had been used to send phishing emails with PDF attachments (bitdefender.com). The sources do not link this to the breach.
Remediação
- Patch and inventory forgotten or legacy websites (including WordPress installations), and segment shared hosting infrastructure (bitdefender.com).
- Decommission or purge old mailboxes, since dormant accounts can still hold large amounts of sensitive correspondence (bitdefender.com).
- Isolate and audit hosting and mail infrastructure and notify affected individuals (securityaffairs.com; general guidance, not specific to this case). AfD says affected account owners have been notified and the attack was reported to security authorities (theregister.com).
- Affected individuals can check exposure by signing in to the HIBP dashboard, since the breach is sensitive and searchable only by the verified email owner (haveibeenpwned.com).
- Change passwords on affected accounts and any reused credentials, use a password manager, and enable 2FA wherever supported; be alert to phishing that draws on leaked email content (haveibeenpwned.com).
- Avoid downloading the torrent: torrents tied to trending topics have been used to distribute malware, and handling stolen personal data carries legal risk (bitdefender.com).
Relatos divergentes
- Scale of the leak: securityaffairs.com (20 October) described a site indexing 421,179 emails with summaries only. bitdefender.com (23 October) reports a 281 GB torrent with the full emails and over 100,000 files, so the raw data appears to be publicly available. haveibeenpwned.com (27 October) says "hundreds of gigabytes" and theregister.com (27 October, most recent) says the attackers exfiltrated over 1 TB; the exfiltrated total may differ from what was published, and none of these figures is independently verified.
- Email count vs. addresses: the actor's 421,179 emails (securityaffairs.com) and HIBP's 345.4k unique email addresses (haveibeenpwned.com) measure different things and are not directly comparable. HIBP's figure is the more authoritative count of exposed addresses.
- Extent of the theft: the AfD says only parts of a few mostly dormant mailboxes were taken (securityaffairs.com, bitdefender.com), or a few accounts while admitting a large volume of data (theregister.com). This sits uneasily with the 421,179-email claim, the 345.4k addresses and messages dated 12 September 2026.
- Initial access: the actor told International Cyber Digest it was "a single unpatched party website" (securityaffairs.com); Wittmann, via theregister.com, specifies a poorly protected WordPress site. These are compatible but unverified by any official source.
- Hosting provider: earlier reports referred only to an unnamed hosting provider; haveibeenpwned.com and theregister.com (27 October, more recent) name it as the AfD-owned Alternita Dienstleistungs GmbH.
- Authenticity: party sources say the emails appear authentic (bitdefender.com), while theregister.com says AfD has not commented on the authenticity of the raw files.
- Summary accuracy: party sources say the AI summaries contain inaccuracies (bitdefender.com), AfD disputes their reliability (theregister.com), and securityaffairs.com notes they cannot be tied to verifiable originals.
Linha do tempo
-
Hack-and-leak against AfD email hosting provider Alternita exposes 345k addresses and over 1 TB of data
ler a análise desta fonte ocultar
The German far-right party Alternative für Deutschland (AfD) disclosed that its email hosting provider, Alternita Dienstleistungs GmbH, was breached in September 2026. Have I Been Pwned confirmed more than 345,000 unique email addresses exposed, along with hundreds of thousands of emails and attachments. AfD says only a few accounts were copied but admits a large volume of data was taken. The material was published on an "activist website" that summarised it with AI into searchable topics, and the raw files are available via torrent. Der Spiegel and others have used the leak for reporting, including on party leader Alice Weidel and illegal donations linked to the 2017 federal elections.
Technical Details
- Per investigative journalist Lilith Wittmann, citing the attackers and party sources, the intrusion was first spotted on September 9 and began with the compromise of a poorly protected WordPress site.
- The attackers reportedly gained persistent access to servers operated by the AfD-owned hosting provider and exfiltrated more than a terabyte of data.
- No official source has verified the attackers' account of the intrusion. The Register has contacted Alternita for comment.
Remediation
- AfD says affected account owners have been notified and that the attack was reported to security authorities.
- AfD has not commented on the authenticity of the raw email files, and disputes the reliability of the AI-generated summaries.
-
AfD data breach via hosting provider Alternita exposes 345k email addresses; hundreds of GB of emails leaked online
ler a análise desta fonte ocultar
In September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach that exposed 345.4k unique email addresses. The following month, hundreds of gigabytes of data, including hundreds of thousands of emails and attachments, were published online with searchable AI-generated summaries and downloadable original files. An analysis of the incident reported that the breach was detected as early as 9 September, with a subsequent intrusion five days later. AfD attributed the breach to an attack on a hosting provider, identified in later reporting as the party-owned Alternita Dienstleistungs GmbH. Have I Been Pwned added the data on 27 Oct 2026 and flagged it as sensitive, so it is not publicly searchable.
Technical Details
- Exposed data: email addresses, plus emails and attachments in the wider leak.
- Intrusion vector: a compromise of a third-party hosting provider, per AfD's public statement. The article gives no technical specifics.
- The leak was published with AI-generated summaries to make it searchable, and the original files can be downloaded.
- No threat actor attribution, CVEs or IOCs are stated.
Remediation
- Affected individuals can check exposure by signing in to the HIBP dashboard, because the breach is sensitive and searchable only by the verified email owner.
- Change passwords on any affected accounts and reused credentials, use a password manager, and enable 2FA wherever it is supported.
- Be alert to phishing that draws on the leaked email content.
-
Hacker leaks 281 GB of AfD emails and files after September hosting provider breach
ler a análise desta fonte ocultar
Germany's far-right party AfD (Alternative für Deutschland) has confirmed that its hosting provider was hacked in September 2026 and that some of its mailboxes were copied. A hacker then published a 281 GB corpus, claimed to hold 421,179 internal emails and more than 100,000 files, via a torrent linked from the Hexane.cc leak site. The AfD says most of the affected mailboxes had not been used for years, but the archive reportedly includes messages dated as late as 12 September 2026. The hacker says the leak is meant to expose the party's "degeneracy and hypocrisy" and claims someone with a Proton Mail address offered 100,000 euros to take the site down.
Technical Details
- Initial access reportedly came through a website that had allegedly been left unpatched. This has not been independently verified.
- The hosting provider's shared infrastructure may not have been properly segmented.
- Hexane.cc does not publish the emails directly. It shows AI-generated summaries categorised by topic (e.g. racism, antisemitism) and rated Low to Critical. Full originals, including headers, bodies, attachments and DKIM signatures, are available only via torrent.
- Party sources say the emails appear authentic but the AI summaries contain several inaccuracies.
- Separately, on 3 September a press spokesman for the AfD group in the Thuringia state parliament warned that his work email account had been used to send phishing emails with PDF attachments.
Remediation
- Patch and inventory forgotten or legacy websites.
- Segment shared hosting infrastructure.
- Decommission or purge old mailboxes, since dormant accounts can still hold large amounts of sensitive correspondence.
- Avoid downloading the torrent: torrents tied to trending topics have been used to distribute malware, and handling stolen personal data carries legal risk.
-
AfD hosting provider breached; hexane.cc publishes AI summaries of 421,179 allegedly stolen party emails
ler a análise desta fonte ocultar
Germany's Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider used by the party was hacked in September and that mailboxes were copied. The anonymous site hexane.cc went online claiming to index 421,179 internal party emails. It does not publish the emails. It shows AI-generated summaries sorted into categories such as racism and antisemitism, with severity ratings from Low to Critical. The AfD says only parts of a few mostly dormant mailboxes were taken, but the index includes messages dated as late as 12 September 2026. Bild reviewed a small sample of files that appeared genuine, including identity documents, invoices, bank statements, membership applications and member lists. The leak is politically sensitive because of pending court proceedings over the party's extremist classification and debates on a possible ban.
Technical Details
- The actor reportedly told International Cyber Digest they gained access through "a single unpatched party website" and then reached the mail servers. This has not been independently verified.
- One server in the archive is labeled "afd_exfil", which suggests a data-staging system.
- The index reportedly includes the mailbox of Alexander Gauland.
- The operators have not named the AI software used for the summaries. None of the summaries has been linked to a verifiable original email, and the pages show "source text not published for this record."
- Exposed data in the files Bild reviewed include full names and home addresses of ordinary members, identity documents (including that of Markus Frohnmaier), and financial records.
- Security researcher Lilith Wittmann considers the leak genuine and the reported attack method plausible.
- By the afternoon of 19 October, the site's About, Method and Support pages were returning server errors.
Remediation
The article gives no remediation guidance. Defenders in comparable situations should patch internet-facing web properties, isolate and audit hosting and mail infrastructure, and notify affected individuals.