German far-right AfD confirms hack of the provider hosting its email accounts

On a website set up by hackers, messages are sorted into categories: racism, antisemitism, threats of violence, ties to the "Reichsbürger" (Reich Citizens) movement, "other illegal activities." They allegedly come from the email accounts of the Alternative für Deutschland (AfD), the German far-right party. The daily Bild, which broke the story, reports more than 421,000 emails.

On October 20, the AfD confirmed that one of its hosting providers had been hit by a cyberattack in September, AFP reports. According to the party, parts of a few email accounts were "apparently" copied illegally.

Two accounts of the leak's scale

The party describes a limited incident. The attack was allegedly "quickly detected and neutralized," those affected were informed, and most of the affected accounts had not been used for years. Federal leaders, it says, were not affected.

Bild claims the opposite on that last point. Emails sent by co-chair Alice Weidel are said to be among the exposed documents, along with a photo of a Bundestag member's ID card. According to Next, which also cites Bild, messages from honorary chairman Alexander Gauland and lawmaker Leif-Erik Holm are reportedly part of the batch.

What does the archive really contain?

The hackers' site does not publish full conversations, only summaries and a sheet listing dates and addresses, likely generated by AI according to Next. The authors point to a 281 GB archive. It would contain the complete messages, with attachments and intact DKIM signatures, the electronic signatures that in principle make it possible to verify that an email has not been altered. No independent verification of this archive has been published so far, and the attack does not appear to have been officially claimed, according to Next. The party says the publications are "under investigation."

The context makes the affair explosive. According to AFP, the AfD leads national polls with about 30% of voting intentions, and it came first in two of the three states (Länder) that held regional elections in September.

Forgotten mailboxes, a risk for every organization

Political parties are regular targets: in France, the website of Les Républicains was hacked in mid-October. Here, according to the party, the weak point is a hosting provider and mailboxes that nobody used anymore. A few habits apply to any organization:

• close inactive mailboxes, or archive them offline, instead of leaving them dormant with a hosting provider;
• enforce multi-factor authentication on all mailboxes, including old ones;
• check the security commitments of your email hosting providers, and know who will warn you in the event of an incident.

The question of origin remains. The hackers' identity and motive are still unknown at this stage.