AfD confirms breach after hacker leaks 281 GB of internal emails with AI-written summaries

Germany's far-right Alternative für Deutschland (AfD) party has confirmed a security breach after a hacker published a 281 GB archive of internal data, said to contain 421,179 internal emails and more than 100,000 files. According to Bitdefender's Hot for Security blog, the party acknowledged that its hosting provider was hacked in September and that some of its mailboxes were copied.

What the party has admitted

The AfD has sought to play down the incident, claiming that most of the affected mailboxes had not been used in years. However, as Bitdefender reports, the leaked archive is said to include messages dated as recently as 12 September 2026, which suggests the compromise extended to accounts that were still receiving mail well after the intrusion began.

The initial access may also have been obtained through a remarkably mundane route. Reports cited by Bitdefender indicate the hacker may have entered via a party website that had allegedly not been patched, although this detail has not been independently verified.

A leak site built on AI summaries

What distinguishes this leak is how the material has been released. Rather than publishing the emails directly, a site called Hexane.cc displays AI-generated summaries of hundreds of thousands of messages, sorted into categories such as racism and antisemitism and rated on a scale from Low to Critical, according to local media reports cited by Bitdefender. Anyone wanting a complete original message — headers, body, attachments and DKIM signatures included — is directed to download the full corpus via a torrent.

That AI layer deserves scepticism. Party sources told media that while the leaked emails themselves appeared to be authentic, the machine-written summaries contained several inaccuracies. It is a useful reminder that automated digests of a large corpus can introduce errors with full confidence, and that readers of such a site are trusting a summarisation model rather than the underlying documents.

The hacker has framed the operation as an effort to expose what they described as the party's "degeneracy and hypocrisy", and has additionally claimed that someone using a Proton Mail address offered 100,000 euros to take the leak site down. Bitdefender adds a practical warning for anyone tempted to grab the torrent: files tied to trending news stories have previously been used to distribute malware, and handling stolen personal data raises legal questions regardless of one's opinions about the people exposed.

Not an isolated incident

The breach is not the AfD's only recent security problem. According to Bitdefender, on 3 September a press spokesman for the party's group in the Thuringia state parliament warned that his work email account had been used to send phishing emails, and urged recipients not to open PDF attachments they had received.

Why it matters

Beyond the political fallout, the incident illustrates three failure modes that are far more common than they should be. First, forgotten or half-maintained websites left unpatched remain a standard way into an organisation's wider infrastructure. Second, shared hosting that is not properly segmented means one compromised system can expose a large slice of an organisation's communications. Third, dormant email accounts are not harmless: even a mailbox nobody has logged into for years can hold years of correspondence that becomes valuable the moment it is stolen.

The leak also previews a likely template for future incidents. Publishing machine-generated, categorised summaries instead of raw documents gives the leaker control over the narrative while outsourcing verification to anyone motivated enough to download the originals — and as the AfD's own response shows, those summaries cannot be assumed to be accurate.