AfD data leak 2026: what is known and how the attack is reconstructed

The AfD data leak raises two separate questions: how messages were taken, and what their contents actually establish. This briefing assesses publicly available reporting as of 22 October 2026. It distinguishes acknowledgements, journalistic reconstructions and unanswered questions.

For readers trying to understand the incident and businesses looking for concrete questions to ask about their own IT. We have not examined the stolen archive ourselves.

Sources and context

What is established, and what are the limitations?

Statement

What the party acknowledges

The AfD acknowledges an attack on a hosting provider and the copying of email mailboxes.

Context: An affected party's account does not independently establish the entire sequence.

AfD: statement of 20 October 2026

Reporting

Technical reconstruction

Wittmann and Hoodinformatik reconstruct access to mail administration.

Context: The reconstruction draws partly on interviews with attackers; it is not a completed forensic report.

Lilith Wittmann: technical reconstruction

Reporting

What a newsroom examined

CORRECTIV reports its own partial examination of messages and documents.

Context: A checked sample does not authenticate every file or establish every claim contained in it.

CORRECTIV: review of 21 October 2026

What is known about the scale

On 20 October, tagesschau reported attackers' claims of approximately 421,000 published emails from ten mailboxes. A party response obtained by the newsroom said older accounts were affected, rather than current federal-party mailboxes. These are a reported collection size and the party's position: neither a complete independent inventory nor a count of affected people. tagesschau: report of 20 October 2026 ↗

What published investigations reveal

CORRECTIV describes membership and address lists, internal disciplinary proceedings and strategy documents. It also reports documents concerning planned Russia contacts. Its checks include metadata, chronology and public registers. A documented travel plan does not establish that a trip happened; complaints or forwarded messages do not establish agreement by their recipients. CORRECTIV: review of 21 October 2026 ↗

Political interpretation therefore depends on the particular investigation: who wrote something, in what capacity, and with what independently checkable consequences? Privacy also requires asking whether unrelated people become identifiable. Reproducing their lists here would add to the potential harm without improving an explanation of the attack.

How the reported attack unfolded

Wittmann and Hoodinformatik describe an inadequately protected WordPress campaign instance. The WP-Console plugin reportedly enabled server access and then access to mail administration. Passwords were changed and mailboxes copied. Their reporting dates discovery in the provider's environment to 9 September and another access to 14 September. Remaining malware is an attacker claim. This does not establish a specifically exploited CVE. Lilith Wittmann: technical reconstruction ↗

Interpreting the reported route – not an additional forensic finding
Area	The security boundary to examine
Website / CMS	Which extensions and administrative access can be executed or changed?
Server / mail administration	Can a compromised web service reach privileged mail functions or their credentials?
Mailboxes / exports	Who can reset passwords or export large datasets, and are these actions logged?

What remains unresolved about the timeline

The AfD's statement places the attack at the end of September. It says mailbox holders and the data protection commissioner were informed promptly and a criminal complaint was filed. These are the party's own assertions. AfD: statement of 20 October 2026 ↗

RND, citing Berlin's data protection authority, instead reports a first notification on 20 October at 18:59. The newsroom contrasts this with the party statement published earlier that day. The discrepancy needs clarification; it is not itself an official finding of a legal violation. RND: response from Berlin's data protection authority ↗

What is the independently confirmed overall impact, including third-party data?
Which logs establish the first access and any subsequent compromise?
Which measures were taken when, and what findings will the responsible authorities publish?

Why screenshots, signatures and AI summaries are not enough

t-online documented fabricated screenshots of purported leaked emails and differences from messages actually available to its reporters. An image circulating on social media therefore cannot establish that a message exists. Even an authentic email requires checks of authorship, forwarding, quotations and timing. t-online: investigation of fabricated screenshots ↗

DKIM can help verify a domain's signature for the signed portions of a message. The standard does not establish factual truth, automatically identify a natural person or authenticate an entire archive. Conversely, a missing signature, or one that can no longer be checked, is not alone proof of forgery. IETF: DKIM, RFC 6376 ↗

Security questions businesses can ask now

Least privilege means giving accounts and processes only the permissions needed for their tasks. That raises a general architectural question: why should a marketing website have broad mail-administration privileges at all? Separate access and tightly scoped permissions can limit the consequences of a compromised service. OWASP: Least Privilege Principle ↗

Credentials need a managed lifecycle: controlled storage, restricted access, rotation, revocation and auditable use. Changing the visible user password is not automatically sufficient when additional tokens or administrative access are affected. This is general preparation, not a claim about the AfD's particular configuration. OWASP: Secrets Management Cheat Sheet ↗

Switzerland's national cybersecurity office recommends examining affected files and administrative computers, updating the CMS and extensions, and involving the hosting provider when a website is compromised. Recovery must address the entry point and potentially remaining access, or reinfection may follow. Swiss NCSC: cleaning up a compromised website ↗

Your business phone needs a security plan too

If you access business email and accounts on your phone, include the device in your security plan. GrapheneOS extends the Android baseline with hardened memory allocation, additional sandbox hardening and a per-app network permission. These measures make certain attacks harder and restrict app access; they do not make a device invulnerable. GrapheneOS: documented security features ↗

Start with an officially supported device that still receives updates. Check the exact model and whether OEM unlocking is available before arranging installation; a SIM-unlocked phone is not automatically suitable. GrapheneOS: supported devices ↗

Our offer · Advertisement: For a business phone configured with security in mind, compare Bissolux's Pixel phones with GrapheneOS. Review available models, complete prices and compatibility with your essential apps before replacing your current device. Explore Pixel phones with GrapheneOS ↗

Already own a suitable Pixel? Our independent send-in service installs GrapheneOS for €350 including VAT and insured return delivery within Germany. You pay inbound postage; installation erases the phone's data. GrapheneOS itself is free – the charge is for our setup service. Have your Pixel set up · €350 ↗

What matters first if your own business suspects a breach

Germany's BSI recommends a coordinated organisational response: clarify responsibilities, bring relevant people together, assess impacts and plan communications. Technical investigation requires preserving evidence. Uncoordinated changes may destroy useful traces, so containment should be agreed with the responsible specialists. BSI: organisational incident response checklist ↗

This article uses only publicly available reporting and guidance. Links appear beside the relevant statements. Political responsibility, privacy consequences and technical cause each need their own evidence; they should not be inferred from a single headline.

Your decision in practical steps

Check publication dates, original sources and the stated scope of verification when reading new reports.
Have your own boundaries between websites, mail administration and privileged credentials reviewed.
Define ownership and a concrete assessment scope for security work; coordinate the response first if an incident is suspected.

Frequently asked questions

Has Bissolux independently verified the leaked files?

No. This briefing assesses already published sources. We claim neither access to the full archive nor an independent forensic authentication.

Does receiving an email mean agreeing with its contents?

No. Receiving, forwarding, quoting and making one's own statement are different actions. Interpretation requires the full context and further checkable information.

Will this article always reflect the latest position?

No. Its stated cutoff is 22 October 2026. Later developments require checking new original reporting, statements or publications by the responsible authorities.

As of 22 October 2026. This is a dated assessment of public sources, not a live status report. Subsequent findings may change the assessment. We do not link to stolen archives or reproduce personal data taken from them. The offer cards and explicitly identified offers advertise Bissolux's own devices and services.