AfD email hosting breach (Alternita Dienstleistungs GmbH) — hack-and-leak exposed 345k accounts, 1TB+ of emails
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
A September 2026 cyberattack on Alternita Dienstleistungs GmbH, the email hosting provider for Germany's AfD party, exposed more than 345,000 unique email addresses and over a terabyte of emails and attachments. Per journalist Lilith Wittmann, attackers compromised a poorly protected WordPress site, gained persistent access to the hosting servers, and exfiltrated the data, which was published on an activist website with AI-generated topic summaries. Leaked content has fueled reporting on alleged illegal donations and internal racist discourse; Der Spiegel reported party leader Alice Weidel may have known about illegal 2017 donations earlier than claimed. AfD disputes the AI-derived summaries but has not disputed the raw files' authenticity. Affected account owners were notified and authorities informed. No vendor patch applies; this is a breach, not a software flaw.
What to do
- Audit and harden externally facing WordPress and other web applications on hosting infrastructure (patching, WAF, least privilege)
- Rotate credentials and review access logs for signs of persistent attacker access on mail/hosting servers
- Encrypt and restrict bulk email archives; minimize retention of sensitive mail data
- Notify affected account holders and regulators promptly per breach-notification obligations
- Monitor for leaked credentials from the dump and force resets where implicated
- Prepare communications distinguishing verified raw leaks from AI-generated summaries
Sources
All live incidents on Threat Watch
