Alternative for Germany confirmed on 19 October 2026 that hackers broke into one of its hosting providers in September. An anonymous website now offers an index of 421,179 emails it says were taken, including the mailbox of honorary chairman Alexander Gauland, with summaries describing swastikas, Nazi greetings and staff planning to throw a photographer out of an event by force. The emails behind those summaries have not been published.
Alternative for Germany (AfD), the party leading Germany's national polls, told Bild late on 19 October: "In September 2026 there was a hacking attack on a hosting provider used by our party." By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party's emails.
In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical. International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland's mailbox and that the newest message is dated 12 September 2026.
According to the summaries ICD relayed, Gauland, the party's 85-year-old honorary chairman and former co-leader, forwarded a 2018 email about a "Hitler pilgrimage" by a former judge on the party's internal court in Thuringia. A district board member sent a Christmas card with a swastika and the words "Heil Hitler". Staff at the party's Berlin headquarters discussed luring a photographer to an event and throwing him out by force, in a thread signed off "hail and victory".
The AfD said the intruders copied parts of a few mailboxes, most unused for years, and never reached the leadership's current accounts. Bild, the only German newsroom known to have examined files from the archive, found identity cards, invoices and member lists consistent with genuine party records. None of the extremism summaries has been matched to an original email.
The AfD won 43.8 per cent in Saxony-Anhalt on 6 September and 38.2 per cent in Mecklenburg-Western Pomerania two weeks later. Infratest dimap put the party at 27 per cent nationally in a survey for the public broadcaster ARD between 28 and 30 September, seven points ahead of Chancellor Friedrich Merz's Christian Democrats and their Bavarian allies. The AfD is contesting in court its classification as extremist by the domestic intelligence agency, and lawmakers in the Bundestag and Thuringia are debating whether to seek a ban.
Nazi imagery and extremist conduct inside the AfD
ICD's thread on 19 October listed what it called the worst items the site had filed under racism and antisemitism. Each is ICD's English rendering of a software-generated summary. Records opened by readers returned the message "source text not published for this record".
Gauland co-founded the AfD in 2013, led the party with Jörg Meuthen and its Bundestag group with Alice Weidel from 2017 to 2021 and is now honorary chairman. The summary says he forwarded a 2018 email concerning a "Hitler pilgrimage" made by a former judge at the arbitration court of the Thuringian branch, the internal tribunal that rules on members' disputes and expulsions. Björn Höcke leads that branch, which the Thuringian intelligence office has classified as confirmed right-wing extremist since March 2021. The summary does not name the judge, say to whom Gauland forwarded the email or record any comment he added.
A district chairman resigned after a fellow board member sent a Christmas card bearing a swastika and "Heil Hitler", according to another summary. The chairman wrote that colleagues had laughed it off.
In a district WhatsApp group, a member joked about turning refugees into handbags and boots, a reference to goods made from the skin and hair of prisoners in Nazi camps. A 2025 email from the North Rhine-Westphalia branch carries a subject line about swastika flags and drugs being sold at a party information stand.
ICD wrote that in 2026 local branches acted against members over a Nazi banner with a swastika, a Hitler impression and a call to turn machine guns on Arab crime families.
Alleged threats and senior party correspondence
A Bavarian official is summarised urging party leaders to chant "Merkel, croak" every day. A thread attributed to staff at the federal office in Berlin, the party's national headquarters, discusses luring a photographer to an event and removing him by force and is signed off "hail and victory", a greeting used in Nazi Germany. The summary names no staff member, photographer or event and does not say whether anything happened.
Bild reported that the site attributes emails to Weidel, now co-leader, to Gauland and to Leif-Erik Holm, a Bundestag member from Mecklenburg-Western Pomerania. Bild did not report what those emails say. ICD attributed none of the extremism items to Weidel or Holm, and apart from Gauland the items it relayed name no individual.
Claims attributed to the leak
The Maltese Herald, a news website, published an article on 20 October headlined "AFD email leak exposes Antisemitism, racism an Nazi nostalgia among party top officials". It said the leak showed Weidel calling Arabs, Sinti and Roma "culturally alien peoples", Gauland justifying Hitler's invasion of Poland in 1939 and the Bundestag member Matthias Helferich calling himself the "friendly face of National Socialism". It said unnamed "IT specialists" had confirmed the leak.
Welt am Sonntag published the email attributed to Weidel in September 2017. The paper said it held a sworn statement from the recipient. The AfD denied Weidel wrote it, and Correctiv concluded that authorship had not been established. Helferich's remark comes from chat messages that predate the hack and were reported in February 2025, when the AfD readmitted him to its Bundestag group; Helferich has said they were parody. No earlier report of a Gauland email about Poland could be found, and the Maltese Herald gave no source.
What has been verified
The AfD has confirmed the September hack and that mailboxes were copied. Bild examined what it called a "very limited" sample of files and found a photograph of the identity card of Markus Frohnmaier, deputy leader of the AfD group in the Bundestag, foreign policy spokesman and chair of the Baden-Württemberg branch. The sample also held other people's identity documents, invoices, bank statements, certificates, membership applications and member lists from district branches in North Rhine-Westphalia.
Lilith Wittmann, a Berlin security researcher who exposed a flaw in the Christian Democrats' campaign app in 2021, wrote on X on 19 October that she considered the leak genuine and the method of access plausible.
The operators have not named the software that wrote the extremism summaries, which remain unconfirmed, and the site's Method page went offline on launch day. The site says its 281 GB download is hash-verified, which shows only that a copy matches the operators' version.
The party's account
The AfD told Bild the intruders copied parts of a few mailboxes, most of which had not been used for years, that the attack was stopped quickly, that all affected users were informed and that the current accounts of the federal office and leadership were never compromised. It said it was examining the circulating material and, according to Bild, gave no details on the scale of the theft.
The archive reportedly includes messages dated as recently as 12 September 2026, although the AfD says most affected mailboxes had been largely inactive for years. The party has not identified the compromised accounts. By the end of 19 October it had also not named the provider or the dates of the intrusion or said whether it had filed a criminal complaint.
Gauland, whose mailbox is in the index according to ICD, left the leadership in 2021. Weidel's emails could reach the archive through recipients' mailboxes without her own account being breached.
The hexane.cc homepage lists the full download at 281 GB, and Dark Web Intelligence, a monitoring account on X, reported a 281.2 GB torrent. The hacker told ICD the complete mailboxes fill 302 GB.
How the breach reportedly happened
The hacker told ICD they got in through "a single unpatched party website" and from there reached the servers hosting the party's email. Conny Ehrenberg, an X user who relayed the exchange in German, described the entry point as a third-party website. The AfD has confirmed only that a hosting provider it uses was attacked in September, and the route of the intrusion has not been independently established. The site's own index file names one server "afd_exfil", a label for a machine used to move stolen data out of a network.
On 3 September Hans-Jörg Jenewein, press spokesman for the AfD group in Thuringia's state parliament, warned contacts that a phishing email with a PDF attachment had been sent from his work address, Handelsblatt reported.
The publishers
ICD said on 19 October that it was in contact with the person behind the leak. The hacker said "the goal was not destruction" and that they could have taken down the party's server cluster and its backups. ICD has published only extracts of the exchange, in which the hacker gave no name, affiliation or motive. No group has claimed responsibility, and nothing published by the end of 19 October tied the operation to a government, party or organisation.
The operators held the material for at least five weeks after the newest email and ran every message through software that assigned a category, a severity grade and a summary. The homepage says severity "reflects the substance of the content itself, not the prominence of any person named in it" and reserves "Critical" for material involving serious harm, crime or violence. Each entry carries a count of the personal identifiers it contains.
The site describes itself as "an independent archive of internal documents, correspondence and records, published in the public interest" and says personal data has been minimised. The operators say they fund the site themselves and accept donations in Monero, a cryptocurrency designed to obscure transaction details. The site is in English with a German language switch. GFrei.News, a German account on X, called it very sloppy and its AI analysis a muddle.
Membership applications and member lists found by Bild carry the names and home addresses of people whose only link to the story is membership of a lawful party, contradicting the site's privacy claim. The operators did not answer Bild's questions, and the site's About, Method and Support pages were returning server errors by late afternoon on 19 October.
Patrick Kolek, an AfD-aligned activist who posts on X as "Wuppi", wrote that another account, @UnheimlichBlond, had warned for months how easy an attack would be and had reported the weakness, a claim that could not be verified. Prosecutors in Koblenz are investigating Kolek in at least 18 cases, including the dangerous dissemination of personal data, and police searched his flat on 16 September, according to t-online, which reported that he denies wrongdoing.
The political setting
The AfD holds 151 of 630 Bundestag seats and 15 in the European Parliament, where it leads the Europe of Sovereign Nations group.
It won 43.8 per cent in Saxony-Anhalt on 6 September 2026, taking 39 of 83 seats. On 20 September it won 38.2 per cent in Mecklenburg-Western Pomerania against 35.5 per cent for Manuela Schwesig's Social Democrats; the Christian Democrats fell to 4.9 per cent and lost their seats. On 6 October the Saxony-Anhalt parliament elected the AfD's Tobias Rausch speaker by 48 votes to 29 with support from the Sahra Wagenknecht Alliance, the first far-right speaker of a German state parliament since 1945. Ulrich Siegmund, the party's lead candidate there, plans to stand for state premier in December and needs 42 votes.
Forschungsgruppe Wahlen recorded a high of 28 per cent for the AfD in a poll for ZDF at the end of July.
The Federal Office for the Protection of the Constitution (BfV), the domestic intelligence agency, classified the AfD as a confirmed right-wing extremist organisation on 2 May 2025, citing an unpublished report of more than 1,000 pages. The party sued, and on 26 February 2026 the Cologne Administrative Court barred the BfV from applying or announcing the classification until the main case is decided. The AfD remains under observation as a suspected extremist organisation, a status the same court upheld in 2022. ZDF reported that the BfV has relied only on public sources in the Cologne case so far.
The Saxony-Anhalt branch carries the confirmed extremist classification from its state intelligence office, as does the Thuringian branch. Höcke was convicted twice in 2024 of using the banned Nazi slogan "Everything for Germany".
Only the Federal Constitutional Court can ban a party, on application by the Bundestag, the Bundesrat or the federal government. A cross-party group of 113 Bundestag members tabled a motion for an application in late 2024 that did not win a majority. In June 2026 the Society for Civil Rights published a report of more than 1,500 pages arguing the party is unconstitutional, and by early August more than 1,000 lawyers, judges and prosecutors had signed an open letter calling for proceedings. The justice committee of Thuringia's state parliament held the first parliamentary hearing on a ban on 30 September. Merz is sceptical, and Thorsten Frei, head of the Chancellery, has said there is no basis for proceedings. Georg Maier, the Social Democratic interior minister of Thuringia, said on 4 October that the party's ties to Russia could decide a ban case.
A ban turns on the aims and conduct of the party as an organisation, so the summaries with the most legal weight, if authenticated, are those involving the federal office and the handling of disciplinary cases. Neither the BfV nor any court has said whether material obtained in a hack could be used.
Within two hours of ICD's first post, accounts on X were citing the archive as grounds for a ban. One wrote that if the data proved genuine, a ban had to follow.
In 2022 the public broadcasters NDR and WDR aired about 40,000 WhatsApp messages from a group of 76 of the 92 AfD members elected to the Bundestag in 2017, including a call to jail Merkel for life and an exchange in which a member asked whether the party wanted to be national socialist or liberal-conservative. The AfD's support rose in the years that followed.
Where the leak stands
The AfD has confirmed that its mail was stolen but not how much. It describes mostly dormant mailboxes, while the archive reportedly runs to 12 September 2026, and it has not identified the accounts taken.
Every allegation of swastikas, Nazi greetings and threats in the archive reaches the public through summaries written by software its anonymous operators have not named. The operators decided which emails to flag, how to grade them and how to describe them, and the emails themselves remain unpublished.
The archive went online as the Cologne Administrative Court weighs whether the domestic intelligence agency may call the AfD extremist, as Thuringia's parliament considers a ban application and two months before Ulrich Siegmund asks Saxony-Anhalt's parliament to elect him state premier.
