AfD email breach: 345,000 addresses leaked via hacked WordPress site
Severity: medium · Patch status: no-fix-needed · Since 2026-10-28
Hackers breached AfD's party-owned IT provider Alternita Dienstleistungs GmbH via a poorly secured WordPress site at wahlkampf.afd.de, reached the mail management system, changed officials' email passwords and exfiltrated data. The intrusion was detected 9 September 2026, but attackers returned on 14 September via undetected malware and copied more data. Over 345,000 unique email addresses and messages were exposed, later offered via torrent and added to HIBP on 27 October as a sensitive breach. Leaked emails also contained excerpts of state branch member databases and unencrypted population-register data, including first-time voters in Mecklenburg-Western Pomerania. AfD notified mailbox owners and the Berlin data protection commissioner on 20 October, though timing is disputed; notification of non-user third parties under GDPR Article 34 is uncertain. Der Spiegel and ZDF reported campaign donation revelations from the emails.
What to do
- Check whether your domain or email addresses appear in the breach via HIBP (domain search or verified owner login)
- Force password resets and review mailbox access logs for any accounts on affected party/provider mail systems
- Notify individuals whose personal data (e.g. voter registry excerpts) appears in leaked emails per GDPR Article 34 if not yet done
- Harden the WordPress site (patching, credentials, plugins) and scan for residual attacker backdoors
- Assess whether retained voter-register data exceeded the one-month post-election deletion requirement
Sources
All live incidents on Threat Watch
