Hack of German party AfD's email host exposed 345,000 addresses

A cyberattack on the email hosting provider of Germany's far-right party Alternative for Germany (AfD) has exposed hundreds of thousands of emails and attachments. It also exposed more than 345,000 unique email addresses. Have I Been Pwned, a site that tracks data breaches, confirmed that number today.

What happened

The attack hit the party's hosting provider in September. AfD disclosed it last week. In an October 20 statement, the party said "only a few email accounts were illegally copied." It also admitted that a large amount of data was taken from them, which it called an extensive data breach.

The stolen emails were posted to what the party calls an activist website. The site summarized email chains into searchable topics. Journalists have since published stories based on the material, including one about a party co-leader's views on colleagues' "deeply problematic" racial discourse.

How the attack may have unfolded

Investigative journalist Lilith Wittmann reported details from conversations with the hackers and party sources. Her report says the attack was first spotted on September 9. It says it began with a poorly protected WordPress site, a common tool for building websites.

She also reported that the criminals kept access to servers run by the hosting provider, named as AfD-owned Alternita Dienstleistungs GmbH. They allegedly took more than a terabyte of data. No official source has verified these claims about how the attack worked. The Register has asked the company for comment.

What AfD says

AfD says the owners of the affected accounts were notified and the attack was reported to security authorities. It calls the hack a crime and an attack on democracy. It also says the leaked content was analyzed with a "very rudimentary AI" that looked at keywords, not context, and that the alleged scandals do not hold up.

Der Spiegel went through the raw files instead. It reported that party leader Alice Weidel seemingly knew about illegal donations tied to the 2017 federal elections weeks before she said she did. The raw files can be downloaded through a torrent, a file-sharing method.

What is not known

• Whether the hackers' account of the attack is accurate.
• Whether the raw email files are authentic. AfD has not commented on that.
• How many people beyond the 345,000 addresses are affected.

The wider lesson

One weakly protected website can open the door to every email an organization keeps. Once the files are copied and shared, they cannot be pulled back. Leaks like this can keep surfacing and drawing new scrutiny for a long time.