Germany’s Alternative für Deutschland (AfD) confirmed on October 19, 2026, that a hosting provider used by the party had been compromised in September 2026. The party said attackers copied portions of several mailboxes.
An anonymous website, hexane.cc, appeared on October 19 with an index it claims represents 421,179 internal AfD emails. The records are presented through AI-generated summaries rather than the underlying messages, preventing readers from comparing the summaries with their purported sources.
The figure of 421,179 refers to claimed email records. It is not a count of affected people, unique mailboxes or independently confirmed stolen messages.
Party records and member information reportedly exposed
According to a SecurityAffairs report published on October 20, Bild examined a small, unspecified sample of files associated with the archive. The documents appeared to Bild to be genuine AfD records and included identity documents, invoices, bank statements, membership applications and regional membership lists.
The material reportedly includes an identity card belonging to Markus Frohnmaier, deputy leader of the AfD parliamentary group in the Bundestag. Some membership documents contain full names and home addresses, exposing people whose apparent connection to the incident is their party membership.
The archive’s operators describe the site as an independent public-interest project and claim to have minimized personal data. The documents reviewed by Bild, however, reportedly include information that could expose members to unwanted contact, impersonation attempts or targeted scams.
AfD said that most of the affected mailboxes had been unused for years and that attackers did not reach the current accounts of the party leadership. Separately, International Cyber Digest (ICD) reported after reviewing the index on October 19 that it includes the mailbox of Alexander Gauland, the AfD’s honorary chairman and former co-leader. ICD also identified September 12, 2026, as the date of the newest indexed message. Those findings do not by themselves establish that a current leadership account was accessed.
Initial-access claim remains unverified
A person presented as the hacker told ICD on X that the intrusion began through “a single unpatched party website” and then progressed to the mail servers. That account of the entry point has not been independently established.
One label appearing in archive filenames is afd_exfil. In security terminology, “exfil” commonly describes infrastructure used to stage information before it is transferred out of a network. The filename alone does not confirm what role that server performed.
Berlin security researcher Lilith Wittmann assessed the leak as genuine and described the claimed attack route as plausible. Her comments support the possibility of the reported chain of compromise but do not verify it.
AI summaries cannot be checked against the emails
Opening an indexed record on hexane.cc produces the message “source text not published for this record.” The operators have also not identified the AI system used to create the summaries.
ICD relayed several inflammatory entries, including summaries alleging references to a “Hitler pilgrimage,” a Christmas card containing a swastika and a Berlin headquarters discussion about forcibly removing a photographer. The site sorts material into categories such as racism and antisemitism and assigns ratings ranging from Low to Critical.
These descriptions remain claims generated from undisclosed source material. Without the original messages—including headers, complete threads, attachments and surrounding context—the site does not provide a way to authenticate individual summaries or determine whether they accurately represent the emails.
By the afternoon of October 19, the site’s About, Method and Support pages were returning server errors, further limiting information about its operators and processing methods.
Consequences extend beyond the political dispute
The publication comes as the AfD contests its classification as a confirmed right-wing extremist organization by Germany’s domestic intelligence agency. The Cologne Administrative Court is considering whether the agency may use that designation publicly, while lawmakers in the Bundestag and Thuringia are debating whether to pursue a party-ban proceeding. Only the Federal Constitutional Court can order such a ban.
Material from an anonymous archive would still need authentication before its evidentiary significance could be assessed. In particular, AI-generated descriptions are not substitutes for original communications. Emails concerning the operation of the national party organization or its handling of disciplinary matters could be politically significant if authenticated, but the public index alone does not establish their contents.
For potentially affected members, the immediate issue is personal-data exposure rather than the archive’s political interpretation. People whose membership, identity or financial documents may be involved should be cautious about unsolicited messages that cite accurate party-related details, independently verify requests for payments or credentials, and monitor relevant financial accounts where banking information may have been included.
