The September 2026 attack on Alternita Dienstleistungs GmbH, the hosting provider for the German party Alternative für Deutschland (AfD), exposed 345,439 email addresses, according to Have I Been Pwned. Have I Been Pwned added the breach to its database on 27 October 2026 and lists email addresses and email messages as the compromised data types. The listing is flagged as sensitive, which means it is not publicly searchable, and only the verified owner of an address can check whether that address appears in it.
Alternita and the September attack
Alternita Dienstleistungs GmbH is a party-owned company that supplies web hosting, accounting and other services to AfD branches and manages hundreds of domains for the party, according to Help Net Security. Have I Been Pwned dates the breach to September 2026 and describes the publication, in the following month, of hundreds of gigabytes of data containing hundreds of thousands of emails and attachments. The confirmed scale for affected accounts comes from the Have I Been Pwned listing, which records 345.4 thousand affected addresses, while the exact figure of 345,439 comes from the Have I Been Pwned entry as indexed by IT Security News.
The incident analysis cited by Have I Been Pwned reports detection as early as 9 September, with a further intrusion about five days later. Help Net Security, reporting on that analysis by investigative journalist Lilith Wittmann, places the second intrusion on 14 September: the intrusion was noticed on 9 September and stopped, but malicious code left behind went undetected and was used to return and copy further data before a second discovery. AfD's own account places the attack at the end of September, and Wittmann wrote that this timing contradicts the available data and the statements of the attackers and of employees of AfD service providers.
| Date | Reported event |
|---|---|
| 9 September 2026 | First intrusion detected, according to the incident analysis |
| 14 September 2026 | Second intrusion, after malicious code left behind was used to return |
| 20 October 2026 | AfD statement confirming the attack |
| 27 October 2026 | Have I Been Pwned adds the breach, listing 345,439 accounts |
The reported entry point remains unverified. Wittmann, citing conversations with the attackers and with people close to the company running the party's IT infrastructure, reported that the attackers entered through a poorly secured WordPress site and from there reached the mail management system, according to Help Net Security. The Register reports the same account and states that no official source has verified the attackers' claims about how the attack unfolded. The Register also reports the attackers' claim, carried in the same analysis, that more than a terabyte of data was exfiltrated. That claim is likewise unverified by AfD or the authorities, and it is stated here only as an attacker claim, not as a confirmed fact.
Scale of the published material
The published material amounts to hundreds of thousands of emails and attachments, according to Have I Been Pwned. The size of the published archive is reported, not confirmed: Bitdefender reports claims that the corpus totals 281 GB and contains 421,179 internal emails and more than 100,000 files. Bitdefender also reports that the archive includes messages dated as recently as 12 September 2026. Those archive figures describe claims about the published corpus and are not a confirmed count of the accounts in the Have I Been Pwned listing.
The Have I Been Pwned breach listing shows AfD with 345.4 thousand affected addresses, added on 27 October 2026, with a breach date of September 2026. Have I Been Pwned's announcement post also reports that 47 percent of the exposed addresses were already present in its database, which shows how often addresses exposed in one breach have appeared in earlier breaches as well. The distinction between the two scales matters for reading the incident: the Have I Been Pwned figure counts the addresses exposed across the copied correspondence, not the number of mailboxes copied, and a mailbox accumulates years of incoming and outgoing mail.
Statement of 20 October 2026
AfD confirmed the attack in a statement on 20 October 2026. The Register quotes the statement as saying that "only a few email accounts were illegally copied" but that a large amount of data was taken from them, resulting in an extensive data breach. Help Net Security quotes the statement in similar terms:
Although only a few mailboxes were unlawfully copied, large amounts of data were leaked.
The statement also said the owners of the affected email accounts had been notified and the attack had been reported to security authorities.
The two descriptions of scale sit side by side without a resolution in the public record. A small number of mailboxes can hold correspondence with a very large number of people, because a mailbox accumulates years of incoming and outgoing mail, and the Have I Been Pwned figure counts the addresses exposed across that correspondence. AfD has not given a victim count of its own, and the number of people whose data appears inside the emails, rather than as mailbox owners, is not confirmed.
One part of the statement is disputed in the reporting. Help Net Security reports that AfD said it had immediately informed the mailbox owners and the data protection commissioner, and that Wittmann noted the Berlin data protection commissioner received the party's breach notification on the evening of 20 October, about two hours after the press release went out. AfD also told Reuters that its current federal-level email accounts were not affected and that most of the affected mailboxes had not been used for years. Those claims are attributed to AfD and are not independently confirmed. The party also said the attack was illegal and called it an attack on the German party system, and said the published claims based on the material did not stand up to scrutiny. No leaked email content is quoted or summarised in this article.
Measures described for affected people
For people whose addresses may be in the breach, published guidance describes a set of standard checks. What to do when an email is in a data breach covers password changes for accounts that shared a password with an exposed address, two-factor authentication, and watching for phishing mail that uses details from the leak. Is Have I Been Pwned safe explains how the checking service handles searched addresses. The limit on checking applies here: because this breach is flagged sensitive, it can only be checked by the verified owner of the address through the Have I Been Pwned dashboard, or by an organisation searching a domain it controls.
The notification question remains open for people who are not mailbox owners. Wittmann argued that it is uncertain whether the numerous people whose data is contained in the leaked emails were informed, even though they were not users of the affected systems, according to Help Net Security. Under Article 34 of the GDPR, people generally have to be notified of a breach likely to result in a high risk to their rights and freedoms. No regulator statement resolving that question has been published at the time of writing.
The breach illustrates a property of email that matters beyond this incident. A mailbox is an archive: years of correspondence, attachments, and contact details sit in one place, so copying a small number of mailboxes can expose a large number of addresses and messages. The same accumulation applies to an address that is reused across many services, because every service that holds that address can connect activity on one service to activity on another when either one leaks. An alias does not protect a mailbox that is itself copied: if the mailbox holding forwarded mail is breached, its contents are exposed regardless of which alias received them. The protection an alias gives is at the point of handing out an address, not inside a mailbox that already holds the mail.
After the Alternita breach, your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Open questions in the investigation
The investigation status is limited in the public record. AfD said the attack was reported to security authorities. No authority has publicly confirmed the attack method, and no victim count beyond the Have I Been Pwned figure has been published. The confirmed facts are the September 2026 breach, the 20 October 2026 statement, and the 27 October 2026 Have I Been Pwned listing of 345,439 accounts with email addresses and email messages exposed. The entry point, the exfiltrated volume, and the size of the published archive remain reported claims, not confirmed facts, and the question of notification for people whose data appears inside the emails remains unresolved.
Top comments (0)