An AfD spokesperson confirmed to Bild, taz and ORF on Oct 20, and to Reuters, that in September 2026 there was "a hacker attack on a hosting provider of our party" in which parts of a few mailboxes, most unused for years, were apparently copied illegally. The party says the attack was quickly detected and stopped, affected users were informed, current mailboxes of the federal party were not affected, and the recent online publication of what is "presumably a portion of this data" is being examined. It didn't say how much data was taken.

A site called hexane.cc posted an index of what it says are 421,179 party emails (281 GB, distributed via BitTorrent) from about ten mailboxes, going back to 2014 and, per taz, up to September 2026. It published AI-generated summaries rather than the emails themselves, rated by severity. Bild says it saw ID-card photos, bank statements and membership lists in a limited look. Reuters reports the site was offline by Tuesday afternoon. Neither the authenticity of the material nor its link to the confirmed hack has been independently verified. taz quotes journalist Lilith Wittmann as saying she believes the data is genuine. No one has claimed responsibility.

Why it matters for defenders: old, unused mailboxes left on a third-party host are still a breach surface. Close or archive dormant accounts and include hosting and email providers in incident-notification contracts.