Attack on AfD email host exposed 345,000 accounts

A cyberattack on the email hosting provider used by Germany's Alternative for Germany (AfD) party exposed more than 345,000 unique email addresses and hundreds of thousands of confidential emails and attachments. Have I Been Pwned confirmed the scale of the breach after AfD disclosed the September attack on its hosting provider last week. The party said only a few email accounts were illegally copied, but admitted that a large amount of data was taken from them.

Scale of the breach

AfD said the owners of affected email accounts were notified and that it reported the attack to security authorities. The emails were added to what the party described as an activist website, which summarized email chains into searchable topics and led to publication of various revelations. Among the AI-generated summaries are chains supposedly expressing views related to Holocaust denial, racist and antisemitic rants, the 9/11 disaster, and forged documents.

Reported attack path

Investigative journalist Lilith Wittmann reported, citing conversations with the cybercriminals responsible and party sources, that the attack was first spotted on September 9 and started with a compromise of a poorly protected WordPress site. The same report claimed the criminals gained persistent access to servers operated by the hosting provider, identified as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data. No official sources have verified the hackers' claims about how the attack unfolded, and The Register contacted Alternita Dienstleistungs for its take.

Party response

AfD said in an October 20 statement that the digital attack is illegal and a criminal offense and called it an attack on the German party system and thus on democracy. The party said it is worried that content of stolen documents was analyzed using a very rudimentary AI focused on keywords rather than context, and said alleged scandals published so far do not stand up to scrutiny. It has not specifically commented on the veracity of raw email files available for download via torrent, and did not immediately respond to a request for input, though it has told reporters it will not comment on whether the emails or stories based on them are to be trusted.

Reporting on the leak

Der Spiegel sifted through the raw files and reported that party leader Alice Weidel seemingly knew about illegal donations related to the 2017 federal elections weeks before she previously said she did. AfD's position is that the AI summaries of the emails are not to be trusted. The leaked material also included a party co-leader's opinions on colleagues' 'deeply problematic' racial discourse.

Sources: The Register