On October 20, 2026, Germany’s far-right AfD confirmed that hackers broke into email accounts belonging to party members and stole large numbers of messages. The party said the attack hit a hosting service provider it uses, and that a small number of mailboxes, most of which had not been used for years, were apparently copied unlawfully in September 2026. According to a report in the Bild daily that the party responded to, more than 421,000 emails were taken, including mail sent by party co-leader Alice Weidel and co-founder Alexander Gauland. Germany’s federal cyber agency, the BSI, said it is in contact with the party.
The attackers, or someone claiming to act on the stolen data, published a website with summaries of the messages. The page was registered anonymously in mid-October and lists a seat in Wyoming in the United States. It does not publish the original mail contents and instead offers AI generated summaries, which the AfD said were produced with a very rudimentary form of AI and, in its view, garbled the context of the stolen documents. Whether the data is authentic remains unverified. Bild reported that the material includes photos of ID cards of party members, including a photo of the ID card of Markus Frohnmaier, the AfD deputy floor leader in the Bundestag, as well as bank statements, invoices, membership applications and membership lists from local AfD branches in North Rhine-Westphalia.
What this breach is, and what it is not
The mechanics matter for anyone who runs email for an organization. This was not domain spoofing. Nobody forged the AfD’s identity and sent mail that pretended to come from its domains. Attackers got into real mailboxes, at a third-party hosting provider, and copied what was really there. That is the nightmare scenario that SPF, DKIM and DMARC were never designed to prevent. Authentication proves that the sender of a message is legitimately allowed to use a domain. It says nothing about whether the person behind the account is an attacker who already has the password, or a provider whose infrastructure has been breached.
Two details are especially instructive. First, the compromised mailboxes were mostly dormant accounts that had not been used for years, including an old contact address for the party’s federal office. Stale mailboxes are a classic blind spot: they still receive mail, they still hold years of sensitive history, but nobody watches them. Second, the current federal association mailboxes were reportedly not affected. The blast radius was limited by where the attack happened, at a single provider, not by any property of the party’s main email infrastructure.
The second wave is where DMARC earns its keep
A leak like this does not end when the data is copied. It starts a second phase, and that phase is squarely in DMARC territory. Within days of any high-profile leak, criminals exploit public curiosity with campaigns that reference it. Expect mail that pretends to offer the full leaked archive behind a link, fake statements from the affected organization, donation appeals or credential harvesting pages dressed up as leak mirrors. Some of that will be sent from lookalike domains registered to imitate the party or the leak site itself.
This is exactly the traffic that DMARC enforcement blocks. If the AfD’s domains are locked down with SPF, DKIM and a p=reject policy, attackers cannot forge convincing mail from those domains, even while quoting real stolen content. Receivers will discard the forgeries. The same applies to every organization whose name gets dragged into a leak cycle: enforcement is what stops your domain from becoming the delivery vehicle for someone else’s story.
Lessons for every sender
- Treat third-party hosting as part of your attack surface. The party was breached through a service provider, not through its own systems. Vendors that hold mailboxes need the same scrutiny as your own servers.
- Hunt down dormant mailboxes. Old accounts that nobody logs into still receive invoices, membership data and personal documents. Archive them, delegate them, or remove them.
- Enforce DMARC before a crisis, not during one. p=reject on your sending domains means the spoofing wave that follows a leak bounces off your domain.
- Watch for lures that reference the leak. Curiosity is the attackers’ best asset right now. The published summaries are designed to make people click to see more.
- Assume stolen content will be re-weaponized. Real quotes inside a fake email are the most convincing phishing there is, and only authentication gives receivers a way to tell them apart.
A breach of mailboxes is a failure of access control. A breach of trust that follows, through forged mail riding on the story, is a failure of authentication. Excello Mail shows you every source that sends as your domains and helps you move to p=reject, so when your name hits the headlines, the spoofers find a locked door. Sign up for free to Excello Mail and close that door before someone tests it.