Germany’s AfD Investigates Cyberattack After Hundreds of Thousands of Emails Appear Online
Germany’s far-right Alternative for Germany (AfD) party is investigating a cyberattack after emails reportedly stolen from accounts linked to the party appeared online, raising questions about data security, digital evidence preservation and the investigation of political data breaches.
Reuters reported on 20 October 2026 that unknown hackers targeted a hosting service provider used by the AfD during an attack the previous month. A party spokesperson said data appeared to have been copied from a small number of email accounts, many of which had reportedly been inactive for years.
German newspaper Bild reported that more than 420,000 emails were published alongside documents said to include bank statements, academic certificates and membership lists. Archived versions of the website reportedly contained approximately 281 gigabytes of material. The website hosting the files was offline by Tuesday afternoon, according to Reuters.
The full extent of the breach remains unclear. The AfD said it was investigating the publication and would provide a preliminary assessment after its inquiry. The reported volume and contents of the leaked data have not yet been independently established in full.
Investigations into large-scale email leaks require investigators to establish how attackers accessed the hosting provider, which accounts were affected, what data was copied and when the unauthorised access occurred.
Digital forensic teams may need to examine authentication logs, server records, email metadata, access histories and copies of published files. Investigators must also preserve evidence integrity and document the chain of custody, particularly when leaked documents may later become relevant to legal proceedings.
The incident illustrates a key challenge in breach investigations: distinguishing verified evidence from claims about the scale and contents of a leak. Until the investigation establishes what happened, the reported figures should be treated as preliminary rather than confirmed findings.