The AfD Hack That Could Actually Help the Party: 421,179 Emails and the Strange Favors of an Anonymous Whistleblower

421,179 emails, 281 gigabytes, a newly registered website, and an alleged hacker who sees himself as a political crusader. A feast for anyone who thinks big numbers automatically mean big revelations. We took a closer look at the data and followed its trail. One question kept coming up, a question that seems to have gotten lost in all the excitement over this supposed devastating blow to the AfD: Why does some of the more recent correspondence read like material the party could use to defend itself in the debate over a possible ban?

The supposedly older messages contain antisemitic statements, racist outbursts, and conflicts that have, in some cases, been public knowledge for years. The more recent entries, however, show AfD officials objecting to Nazi symbols or demanding disciplinary action. On May 28, 2025, Andreas Keith allegedly made the serious accusation in Bottrop that a district executive board member had sold swastika flags and drugs at an information booth. He demands action. Correspondence from Aachen contains complaints about antisemitism and Holocaust denial and trivialization. In North Rhine-Westphalia, a suspension is being demanded over racist posts. An entry from Rostock, dated April 19, 2026, reportedly calls for the immediate expulsion of a party member over a depiction of a swastika.

Another trail leads back to the Swiss donations scandal involving Alice Weidel. An alleged message from November 2018 reportedly suggested retroactively treating a questionable campaign donation as an interest-bearing loan. The scandal itself is already well known. Whether the message is authentic and what consequences it had cannot be determined from an automated description alone. The old problem has a new envelope, but no new proof.

The allegations against the individual members are therefore far from proven. Nor is it clear whether any of the requests were acted upon. Yet, according to the alleged emails, the documents appear to show something that could carry weight in proceedings to ban the party: At least some resistance to far-right extremism is being organized within the party itself. Whether that resistance has actually accomplished anything is another question entirely. There were already calls for expulsions in 2018 and 2022. So the seemingly neat progression over time could simply reflect which mailboxes happen to be included in this archive.

That's why we have serious doubts about whether this supposedly devastating breach actually hurts the AfD politically. A collection that produces requests to expel neo-Nazis at just the right moment could hand the party arguments in its defense, even if disturbing statements are documented elsewhere. Those requests would certainly not settle the legal requirements for banning a political party. But why should we automatically assume this release has the opposite effect of what its more recent messages actually suggest?

On October 20, the AfD stated that an IT service provider it uses had been attacked in late September. The exact date remained unclear. Technical connections pointed toward afd-hosting.de and a company called Alternita, although neither establishes which provider was actually compromised. The party said some of the affected mailboxes had been unused for years. However, the published material reportedly also includes a mailbox from North Rhine-Westphalia that was still in active use. According to the documented information, Berlin's data protection authority received a notification on October 20 at 6:59 p.m. What happened between the alleged September attack and that notification deserves a precise explanation.

The website used to publish the material, hexane.cc, was registered on October 15 at 10:32:36 p.m. UTC, when it was already October 16 in Germany. The registrar was NiceNIC International Group. The registered owner's identity was concealed behind "REDACTED FOR PRIVACY," and the listed U.S. state of Wyoming does nothing to help identify that person. Even the earliest registration record examined already contained that privacy protection. Cloudflare provides the technical infrastructure. None of this reveals who is behind the site.

The public trail emerges on October 19. By 3:45 p.m. at the latest, a post by back2theRoot on chaos.social had been shared by pixelroiber. It was already describing a massive AfD data leak. At 8:31:05 p.m. UTC, else42 posted a link to the archive on Hacker News. That account has existed since January 2018. These names are among the earliest identifiable distributors. So far, we have found no evidence that any of them registered the website or organized access to the AfD's systems.

The domain itself left additional traces. One publicly visible record reads "t-verify=f5004013677251d8e7d1d001fb7ef698". The identifier matches the format used to verify a custom domain with the encrypted email service Tuta, formerly Tutanota. Records also pointed to Cloudflare's email forwarding service and a certificate issued by Let's Encrypt. The 2 identified IP addresses, 172.67.212.198 and 104.21.61.183, also belong to Cloudflare.

According to the operators themselves, they processed and automatically summarized approximately 103,000 files. They are asking for donations, preferably in Monero, a cryptocurrency designed to provide particularly strong financial privacy. The collection appears organized, but its origins remain obscure. The October 15 domain registration tells us nothing certain about when the processing began. The work could have started earlier. That's precisely why we want to know who selected the messages and how their significance was assessed.

Then an alleged attacker enters the picture, through International Cyber Digest. According to his account, he exploited an unpatched party website, escalated his privileges, and gained access to email backups. He claimed he could have damaged the infrastructure but chose to publish the data instead. Supposedly, his goal was to expose financial irregularities and contradictions. A hacker forum reportedly contained claims involving more than 800 compromised computers. The original post could not be independently examined. The allegation that someone offered 100,000 euros through an anonymous Proton address to have hexane.cc shut down also remains unsupported by any independently verified original evidence.

An earlier warning raises even more questions. On September 3, reports emerged that a fraudulent message had been distributed through the official email address of Hans-Jörg Jenewein, the AfD spokesman in Thuringia. Patrick Kolek also pointed to the account ….(@)UnheimlichBlond, which had allegedly been warning about security vulnerabilities for months. Even the name HEXANE leads down another trail: In cybersecurity research, the same name is used for a cyberespionage group attributed to Iran, also known as Lyceum. We have not been able to establish any connection to hexane.cc at this point.

We know neither the person behind the domain nor the actual method of access. NiceNIC's payment records and the affected service provider's server logs are not publicly available. Those gaps alone should make anyone suspicious of people who draw sweeping political conclusions from an anonymous archive. Whether an outsider broke in or someone with existing access handed over the data remains unclear. And whether the selection was deliberately designed to portray the AfD's more recent conduct favorably is even further from being established. Meanwhile, the amateur journalists and click chasers will be crawling out of the woodwork again, loudly promoting investigations they haven't even conducted yet while preemptively warning everyone against other people's work, as though they personally invented journalistic integrity. The questions that actually matter apparently interest them less than their own self-importance: Who carried out the attack, who released the data, and why? Only once those questions have been seriously investigated can the contents of the emails themselves be examined with the necessary care.

The most uncomfortable part of this story sits right in the middle of the supposedly explosive emails. While everyone around us celebrates a historic blow against the AfD, the more recent messages contain demands for action against far-right extremists. That could matter in the debate over a possible party ban. Anyone claiming deliberate deception would need to prove how the documents were selected and what decisions the party actually made. We aren't going to overlook this strange situation just because the words "hacker attack" offer an easy way to manufacture journalistic importance. In this world, what matters is who had access, how the systems were compromised, and who decided what would be released. As long as those questions remain unanswered, others are welcome to celebrate themselves as great investigative journalists or savor the wild scent of those hard-won clicks. We're interested in the trails they'd apparently rather not follow, or simply aren't capable of following.