AfD data breach: 281 GB of internal emails leaked via unpatched web asset
AfD, Germany’s far-right Alternative für Deutschland party, confirmed a data breach after a hacker published 281 GB of internal emails. The leak surfaced on the Hexane.cc site, which hosts AI-generated summaries of the messages and encourages downloading the full archive via torrent.
Attack path and exposure
The party’s own admission that its hosting provider was compromised in September points to a supply-chain vector. Subsequent analysis suggests the attacker accessed the data through a web asset that remained unpatched. While the exact vulnerability is not yet publicly disclosed, the scenario fits a classic web-application flaw—such as an unpatched CMS or legacy framework—allowing remote code execution or directory traversal. The compromised asset provided a foothold that enabled the attacker to enumerate and copy mailboxes, including those not used for years.
The leaked corpus contains 421,179 emails, with timestamps as recent as 12 September 2026, and more than 100,000 files. The data set is available for download as a 281 GB torrent, which includes full headers, bodies, attachments, and DKIM signatures. The site also publishes AI-written summaries categorized by content type and severity, though party sources note inaccuracies in the summaries.
Evidence and log sources
Defenders can validate the breach by inspecting the following logs:
- Web server access logs – Look for anomalous requests to the unpatched asset, especially POST or GET requests to administrative endpoints.
- Email server logs – Search for outbound traffic to unknown IPs or unusual authentication attempts around the September timeframe.
- Hosting provider incident reports – Verify the provider’s notification of a breach and any remediation steps taken.
- DNS records – Check for changes to the domain’s A or CNAME records that could indicate a hijacked site.
Mitigation steps for similar environments
- Patch management – Ensure all public-facing web applications are updated to the latest security releases. Automate vulnerability scanning and enforce a strict patch window.
- Segmentation – Isolate email infrastructure from web servers. Use network segmentation and firewall rules to restrict lateral movement.
- Mailbox hygiene – Regularly audit mailbox usage. Disable or delete accounts that have been inactive for extended periods, and enforce strong authentication for all accounts.
- Monitoring – Deploy SIEM or log-analysis tools to detect anomalous access patterns to email servers and web assets.
- Incident response readiness – Maintain an up-to-date playbook that includes steps for handling compromised email archives and third-party data leaks.
Broader implications for political organizations
The AfD breach underscores that political parties, like any organization, must treat all digital assets with equal scrutiny. Even dormant accounts can contain recent activity, and unpatched web components can serve as entry points for attackers. The use of a torrent for distribution introduces additional malware vectors, reminding defenders to treat any downloaded content as untrusted until verified.
Next steps for defenders
- Verify the patch status of all public web assets and apply missing updates.
- Conduct a comprehensive audit of email accounts, focusing on recent activity and attachment handling.
- Review hosting provider incident reports for details on the initial compromise.
- Implement stricter segmentation between web and email infrastructure.
- Monitor for signs of data exfiltration or unauthorized access to email archives.
More from our coverage
For a deeper dive into how third-party AI agents can slip through identity controls and expose enterprise data, see the related post on Third-Party AI Agents Slip Through Identity Controls, Exposing Enterprise Data.