AfD hosting provider breached; hexane.cc publishes AI summaries of 421,179 allegedly stolen party emails
Germany's Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider used by the party was hacked in September and that mailboxes were copied. The anonymous site hexane.cc went online claiming to index 421,179 internal party emails. It does not publish the emails. It shows AI-generated summaries sorted into categories such as racism and antisemitism, with severity ratings from Low to Critical. The AfD says only parts of a few mostly dormant mailboxes were taken, but the index includes messages dated as late as 12 September 2026. Bild reviewed a small sample of files that appeared genuine, including identity documents, invoices, bank statements, membership applications and member lists. The leak is politically sensitive because of pending court proceedings over the party's extremist classification and debates on a possible ban.
Technical Details
- The actor reportedly told International Cyber Digest they gained access through "a single unpatched party website" and then reached the mail servers. This has not been independently verified.
- One server in the archive is labeled "afd_exfil", which suggests a data-staging system.
- The index reportedly includes the mailbox of Alexander Gauland.
- The operators have not named the AI software used for the summaries. None of the summaries has been linked to a verifiable original email, and the pages show "source text not published for this record."
- Exposed data in the files Bild reviewed include full names and home addresses of ordinary members, identity documents (including that of Markus Frohnmaier), and financial records.
- Security researcher Lilith Wittmann considers the leak genuine and the reported attack method plausible.
- By the afternoon of 19 October, the site's About, Method and Support pages were returning server errors.
Remediation
The article gives no remediation guidance. Defenders in comparable situations should patch internet-facing web properties, isolate and audit hosting and mail infrastructure, and notify affected individuals.
Linha do tempo
-
AfD hosting provider breached; hexane.cc publishes AI summaries of 421,179 allegedly stolen party emails
ler a análise desta fonte ocultar
Germany's Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider used by the party was hacked in September and that mailboxes were copied. The anonymous site hexane.cc went online claiming to index 421,179 internal party emails. It does not publish the emails. It shows AI-generated summaries sorted into categories such as racism and antisemitism, with severity ratings from Low to Critical. The AfD says only parts of a few mostly dormant mailboxes were taken, but the index includes messages dated as late as 12 September 2026. Bild reviewed a small sample of files that appeared genuine, including identity documents, invoices, bank statements, membership applications and member lists. The leak is politically sensitive because of pending court proceedings over the party's extremist classification and debates on a possible ban.
Technical Details
- The actor reportedly told International Cyber Digest they gained access through "a single unpatched party website" and then reached the mail servers. This has not been independently verified.
- One server in the archive is labeled "afd_exfil", which suggests a data-staging system.
- The index reportedly includes the mailbox of Alexander Gauland.
- The operators have not named the AI software used for the summaries. None of the summaries has been linked to a verifiable original email, and the pages show "source text not published for this record."
- Exposed data in the files Bild reviewed include full names and home addresses of ordinary members, identity documents (including that of Markus Frohnmaier), and financial records.
- Security researcher Lilith Wittmann considers the leak genuine and the reported attack method plausible.
- By the afternoon of 19 October, the site's About, Method and Support pages were returning server errors.
Remediation
The article gives no remediation guidance. Defenders in comparable situations should patch internet-facing web properties, isolate and audit hosting and mail infrastructure, and notify affected individuals.