AfD Email Leak: Hacktivism and European Political Unrest
جدول المحتويات
On 19th October, Germany’s far-right Alternative for Germany (AfD) experienced one of the largest data breaches to ever hit a political party. The breach allegedly exposes over 281 GB of data, including 102,985 files and around 420,000 emails. The AfD has confirmed the breach, and says the attack on its hosting provider took place in September 2026.
As Europe heaves under some of the most serious student protests it has seen in years, cybercriminal activities are an unexpected threat that should have been anticipated and planned for. With AI-powered tools, sophisticated hacking and cyber interference is an increasingly accessible force that will be exploited across borders. As with any other industry, cyberattacks are increasingly likely to play a central role in periods of political tension today as well.
ماذا حدث؟
On Monday, a malicious actor known as “hexane_cc” published a post on a popular dark web forum, claiming to have breached over 800 AfD-related hosts. This resulted in about 281 GB of data being exfiltrated, primarily consisting of email communications between members, documents, and databases used by the political party.
From the information provided by representatives of the AfD, it appears that the attacker breached the hosting provider the far-right party was using, and copied data from a small number of email accounts, most of which had not been used for years. The lack of other data exposed, or reports of other breaches, suggests this was a targeted attack.
Who is “hexane_cc”?
Little is known about this actor, who appears to have created their profile on the forum just a day before they published the breach. Our investigation did not find any links to any established hacking or ransomware groups, or historical aliases they may have used.
Essentially a ghost, and difficult to track down.
Even their proprietary website contains no additional data, and serves as an archive of the data stolen from AfD.
Is it hacktivism?
Most likely, yes. According to the International Cyber Digest, an independent cybersecurity news publication, an anonymous individual had offered the cybercriminal 100,000 euros to take the leak offline. So far this does not seem to have worked, and the stolen data appears to be publicly available for anyone to download.
The website of “hexane_cc” claims their breach is publicly available to journalists, researchers and members of the public, suggesting that their goals are not financial.
An increase in hacktivism targeting both political organisations as well as prominent corporations should be expected as the political atmosphere of Europe turns volatile. A youth initiative in Germany, Gen Z steht auf, has called for a nationwide demonstration for the 31st of October.
Periods of mobilisation and increased tension such as this tend to attract both opportunistic and ideologically driven cyber activity on all sides.
What does the data contain?
The leak comes in two parts.
The full dataset, containing clear text data, email headers, bodies and attachments with DKIM signatures intact, is availble for download via torrent.
A curated, searchable archive, also hosted by the attacker:
- Material filterable by type: correspondence, mailboxes, documents, databases and sensitive records.
- Severity rating assigned, from low to critical. The rating appears to be based on potential political damage, not cybersecurity impact. “Critical” contains data “involving serious harm, violence, criminal conduct or severe discrimination”, while “low” covers “marginal or contextual material”.
- Each item is also tagged by theme, with labels such as “racism_xenophobia”, “antisemitism_extremism”, and “illegal_activity”.
The level of curation confirms the attacker’s political motivations. The archive is designed for fast consumption by journalists and the public. The tagging is clearly built to make the most politically damaging content the easiest to find. Note that the archive shows summaries of the emails rather than the original messages, and many of the allegations remain unverified.
Why this matters beyond AfD
The rise in domestic political tensions across countries is notable and will have a cybersecurity impact.
CybelAngel observations of cybercriminal activities during periods of international political and military crisis indicate a first wave of politically motivated hacktivist groups targeting perceived enemy organisations. If the period of unrest continues, this wave of cyberattacks is joined by opportunistic financially motivated groups.
Organisations, whether political parties, campaigns, NGOs, think tanks, or corporations that hold politically exposed positions, should prioritise cybersecurity in times of volatility.
1. Your hosting provider is part of your attack surface. The attacker reportedly went through the AfD’s hosting provider rather than the party’s own systems. Organisations should know which third parties hold their email, documents and databases, what security controls those providers apply, and how fast they would detect and disclose a compromise.
2. A leak is a starting point for further abuse. With over 400,000 authentic emails publicly available, follow-on risks include:
- Spear-phishing that reuses real threads, names and signatures
- Exposure and harassment of individual members, staff and correspondents, many of whom are private individuals
3. “Leak and curate”. Pre-sorted, tagged and severity-rated data shortens the time between exfiltration and reputational damage from weeks to hours. Incident response plans need to cover public exposure as well as technical containment: legal review, communications, and support for affected individuals.
إنهاء
The AfD breach is a warning for any organisation with a political profile. An unknown actor, a third-party provider, and a leak curated for maximum damage within hours.
As tensions rise across Europe, organisations should map the third parties that hold their data, prepare for public exposure as well as technical containment, and watch the dark web for early signs of a breach, before journalists and the public find it first.
سايبل أنجل مراقبة الويب المظلم tracks mentions of your organisation on underground forums and marketplaces, so you can act before a leak turns into a crisis.
عن المؤلف
