Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

AfD hosting breach exposed 345,000 email addresses, HIBP says

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Have I Been Pwned lists more than 345,000 AfD-related addresses from a September attack on host Alternita as a sensitive breach.

A September cyberattack on Alternita Dienstleistungs GmbH, the email host for Germany’s Alternative für Deutschland (AfD), exposed confidential emails, attachments, and more than 345,000 unique addresses, Have I Been Pwned said. AfD says only a few mailboxes were copied, a large amount of data was taken, and material later appeared on an activist site. Journalist Lilith Wittmann, citing the attackers, says entry began on September 9 through a poorly protected WordPress site, passwords were changed, and a second intrusion followed on September 14; officials have not verified that account, and AfD has not confirmed the raw email files. HIBP added the leak on October 27 as a sensitive breach searchable only by verified owners. AfD notified mailbox holders and the data protection commissioner and disputes AI-written summaries.

Key facts
  • HIBP confirmed more than 345,000 unique email addresses and messages.
  • AfD says a few mailboxes were copied and data reached an activist site.
  • Wittmann says access started September 9 via a poorly secured WordPress site.
  • She says attackers returned September 14 using leftover code.
  • Leaked material reportedly includes unencrypted population-register records.
  • The party disputes AI-written summaries of the stolen mail.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Sep 9, 2026Intrusion via poorly protected WordPress began, Wittmann says · The Register
  2. Sep 14, 2026Attackers reportedly returned using leftover code · Help Net Security
  3. Oct 27, 2026Have I Been Pwned added the leak as a sensitive breach · Help Net Security

What each outlet adds

beyond the shared facts
  • The RegisterNames Alternita, cites over a terabyte, and notes unverified criminal account
  • Help Net SecurityHIBP sensitive listing, September 14 return, and registry-record claims
Products
WordPress
Victims
Alternative for GermanyAlternita Dienstleistungs GmbHAlternative für Deutschland
Organizations
Have I Been PwnedAlternita Dienstleistungs GmbH
Countries
Germany

Coverage

oldest first · one row per article · UTC
  1. · 3d ago The Register · SecurityFirst report

    AfD email-host breach exposed 345,000 addresses, HIBP says

    Have I Been Pwned confirmed the scale after the party disclosed a September attack on its hosting firm, Alternita.

  2. · 2d ago Help Net Security

    AfD breach exposes 345,000 email addresses and messages

    Have I Been Pwned added the September leak on October 27 as a sensitive breach, so only verified owners can search it.