AfD Email Breach Exposes 421,179 Messages in a 281 GB Archive

The AfD breach shows how forgotten mailboxes and overlooked web infrastructure can expose years of sensitive correspondence. The archive reportedly spans 281 GB, with 421,179 internal emails and more than 100,000 files—far beyond the party’s claim that most affected mailboxes had been unused for years. Those figures describe a large collection, but they don’t establish how much of it is sensitive, how many people are affected, or whether every item is genuine. The scale does, however, make one point plain: an account can remain a security risk long after its user stops checking it.

What the archive contains

Germany’s Alternative für Deutschland confirmed that its hosting provider was hacked in September and that some mailboxes were copied. Although the party said most had not been used for years, the published archive reportedly includes messages dated as recently as 12 September 2026. That gap between the party’s description and the material’s reported contents raises questions about what “unused” means in practice: an inbox might receive little attention while still accumulating messages, attachments, and records that remain accessible through shared infrastructure.

The Hexane.cc leak site presents AI-generated summaries grouped by themes such as racism and antisemitism, with ratings from Low to Critical. This kind of presentation gives readers a quick route into a large cache, but the labels and summaries also shape what people notice first. A theme grouping can make a collection easier to browse while stripping messages of the context that explains who was speaking, what prompted a reply, or whether a quoted statement was endorsed. Readers seeking original messages, including headers, attachments and DKIM signatures, are directed to download the material through a torrent.

That format makes the summaries a poor substitute for the underlying records. AI systems can state errors confidently, and AfD sources told media outlets that while the emails appeared authentic, the summaries contained several inaccuracies. Authenticity and interpretation are separate questions: a real message can still be presented misleadingly if its surrounding conversation is missing, while an automated summary can misread a passage even when the source document is genuine. This is more significant than it looks, because a confident but faulty synopsis can travel faster than the document it purports to explain.

Unverified access claims and a risky download

Reports suggest the attacker may have gained access through an unpatched website, though that account hasn’t been independently verified. If that route is accurate, it would fit a familiar pattern in which exposed web software becomes a path toward data held elsewhere. But the available account doesn’t establish which system was entered, what vulnerability was involved, or how access reached the mailboxes. Those details matter when assessing the breach, and they shouldn’t be filled in by guesswork.

The hacker says the release is meant to expose the party’s “degeneracy and hypocrisy.” They also claim that someone using a Proton Mail address offered €100,000 to take the leak site down. These are claims attributed to the hacker, not independently established facts. The stated motive may help explain how the release is being framed, but it can’t verify the archive, the alleged offer, or the accuracy of the summaries. Here’s the thing: a political purpose doesn’t make a leaked collection self-explanatory.

Downloading the torrent carries risks beyond the sensitivity of the stolen data. Torrents tied to high-profile news have previously been used to spread malware, and handling personal information taken in a breach can raise legal questions. The summaries also shouldn’t be treated as reliable evidence without checking the original material. For readers, that leaves a basic but inconvenient trade-off: the records may be necessary to assess claims about the archive, yet obtaining and circulating them can expose people to security and privacy risks.

A familiar security failure

This incident follows another AfD-related email problem: on 3 September, a press spokesman for the party’s group in Thuringia said his work account had been used to send phishing emails and warned recipients not to open PDF attachments. The source doesn’t establish that the two incidents share a cause. Still, the earlier warning underscores how email accounts can become a route for attacks on colleagues, contacts, and the public, not just a store of correspondence.

The broader lesson is operational. An old mailbox can still hold valuable correspondence, while an overlooked website can become an entry point into shared systems. Organizations need to keep internet-facing software patched, limit how far a compromised account or server can reach, and include dormant mailboxes in security reviews. That work is mundane, and it’s easy to defer when an account appears inactive. Yet old data doesn’t age out of attackers’ reach on its own.

What the breach means for organizations and readers

For organizations, the case points to a mismatch between how people judge an account and how systems retain its data. A mailbox may be “unused” in the everyday sense and still have credentials, stored messages, or connections that make it worth protecting. Security reviews therefore need to account for the systems around an account as well as the account itself: who can access it, what services depend on it, and whether old access should still exist. If you’re working in this space, dormant accounts belong on the review list alongside active ones.

For readers, the archive calls for restraint in drawing conclusions from either the summaries or isolated messages. A large volume of material can create an impression of completeness, but size alone doesn’t show whether the collection is comprehensive, whether records are missing, or how accurately they’ve been described. The most responsible reading keeps attribution visible and treats claims about the breach, the attacker’s motive, and the archive’s contents according to the evidence available. And yet, even with those limits, the incident offers a clear warning about neglected infrastructure.

Unused email accounts don’t stop being sensitive simply because nobody checks them.