Source: heise online
A large data leak from the German party Alternative fur Deutschland surfaced on 20 October 2026, with attackers publishing approximately 280 GB of material including about 420,000 emails from ten mailboxes, more than 41,000 PDFs, thousands of word processor documents and several SQL database dumps. According to reporting by heise online, the compromised mailboxes include those of the party’s federal arbitration court, prominent members and the federal business office. The attackers made the full dataset available as a torrent and also published a searchable website so anyone can browse the contents. In a statement quoted on Telegram, the attackers claimed they entered through an outdated website, and a security expert consulted by heise assessed the incident as hacktivism rather than an insider job.
The weakest system decides the blast radius
The details that matter for every organisation are architectural. A single outdated web server apparently became the entry point, and from there the attackers reached mail servers, file stores and databases. Once inside a network segment without isolation, the compromise stopped being about one system and became a full communications archive in public view. German media covering the leak note that the published material is now being searched for financial irregularities, which is exactly the kind of downstream damage that outlasts the incident itself.
Email archives are among the most valuable assets an organisation owns, and among the least monitored. Regular patching of every internet-facing system, network segmentation that keeps web servers away from mail and database infrastructure, multi-factor authentication on administrative accounts and tested backups are the boring controls that would have prevented most of this outcome.
If your organisation runs its own mail and web infrastructure and you want an independent review of exposure, patching discipline and segmentation before someone else tests it for you, contact Excello Digital at https://excello.digital/contact/. We help European organisations harden self-hosted infrastructure and keep confidential communication confidential.