In September 2026, Germany’s Alternative für Deutschland (AfD) political party suffered a data breach that exposed roughly 345,000 unique email addresses. The following month, hundreds of gigabytes of data—including emails and attachments—were published online in a searchable form, complete with AI-generated summaries and downloadable original files. Reporting indicated the intrusion was first detected around 9 September, with a second intrusion five days later. AfD attributed the incident to an attack on a hosting provider later identified as its party-owned Alternita Dienstleistungs GmbH.
The exposed email addresses and internal correspondence present clear identity risks: harvested addresses fuel targeted phishing and credential-stuffing, while leaked internal communications can aid social engineering and account takeover against party members and staff.
What to take away: breaches rooted in a third-party or affiliated hosting provider show why supply-chain and hosting dependencies must be included in identity risk assessments—exposed credentials and contact data should prompt forced resets, monitoring for credential reuse, and heightened phishing vigilance.