Hacker leaks 281 GB of AfD emails and files after September hosting provider breach
Germany's far-right party AfD (Alternative für Deutschland) has confirmed that its hosting provider was hacked in September 2026 and that some of its mailboxes were copied. A hacker then published a 281 GB corpus, claimed to hold 421,179 internal emails and more than 100,000 files, via a torrent linked from the Hexane.cc leak site. The AfD says most of the affected mailboxes had not been used for years, but the archive reportedly includes messages dated as late as 12 September 2026. The hacker says the leak is meant to expose the party's "degeneracy and hypocrisy" and claims someone with a Proton Mail address offered 100,000 euros to take the site down.
Detalhes técnicos
- Initial access reportedly came through a website that had allegedly been left unpatched. This has not been independently verified.
- The hosting provider's shared infrastructure may not have been properly segmented.
- Hexane.cc does not publish the emails directly. It shows AI-generated summaries categorised by topic (e.g. racism, antisemitism) and rated Low to Critical. Full originals, including headers, bodies, attachments and DKIM signatures, are available only via torrent.
- Party sources say the emails appear authentic but the AI summaries contain several inaccuracies.
- Separately, on 3 September a press spokesman for the AfD group in the Thuringia state parliament warned that his work email account had been used to send phishing emails with PDF attachments.
Remediação
- Patch and inventory forgotten or legacy websites.
- Segment shared hosting infrastructure.
- Decommission or purge old mailboxes, since dormant accounts can still hold large amounts of sensitive correspondence.
- Avoid downloading the torrent: torrents tied to trending topics have been used to distribute malware, and handling stolen personal data carries legal risk.
Linha do tempo
-
Hacker leaks 281 GB of AfD emails and files after September hosting provider breach
ler a análise desta fonte ocultar
Germany's far-right party AfD (Alternative für Deutschland) has confirmed that its hosting provider was hacked in September 2026 and that some of its mailboxes were copied. A hacker then published a 281 GB corpus, claimed to hold 421,179 internal emails and more than 100,000 files, via a torrent linked from the Hexane.cc leak site. The AfD says most of the affected mailboxes had not been used for years, but the archive reportedly includes messages dated as late as 12 September 2026. The hacker says the leak is meant to expose the party's "degeneracy and hypocrisy" and claims someone with a Proton Mail address offered 100,000 euros to take the site down.
Technical Details
- Initial access reportedly came through a website that had allegedly been left unpatched. This has not been independently verified.
- The hosting provider's shared infrastructure may not have been properly segmented.
- Hexane.cc does not publish the emails directly. It shows AI-generated summaries categorised by topic (e.g. racism, antisemitism) and rated Low to Critical. Full originals, including headers, bodies, attachments and DKIM signatures, are available only via torrent.
- Party sources say the emails appear authentic but the AI summaries contain several inaccuracies.
- Separately, on 3 September a press spokesman for the AfD group in the Thuringia state parliament warned that his work email account had been used to send phishing emails with PDF attachments.
Remediation
- Patch and inventory forgotten or legacy websites.
- Segment shared hosting infrastructure.
- Decommission or purge old mailboxes, since dormant accounts can still hold large amounts of sensitive correspondence.
- Avoid downloading the torrent: torrents tied to trending topics have been used to distribute malware, and handling stolen personal data carries legal risk.