AfD email hosting provider attack exposed 345k accounts, The Register reports

What happened

The Register reports that an attack on the email hosting provider of Alternative for Germany (AfD) exposed hundreds of thousands of confidential emails and attachments, and more than 345,000 unique email addresses. According to The Register, Have I Been Pwned confirmed the scale of the breach after AfD disclosed the September attack on its hosting provider the previous week (The Register).

• What AfD says: In an October 20 statement, AfD said that “only a few email accounts were illegally copied.” It admitted that a large amount of data was taken from those accounts. AfD also said it notified the owners of the affected accounts and reported the attack to security authorities (The Register).
• Where the emails ended up: The Register says the emails were added to what AfD called “an activist website.” That site summarised the email chains into searchable topics. The Register also says raw email files are available for download via torrent (The Register).
• How the attack allegedly unfolded: The Register cites a report by investigative journalist Lilith Wittmann, based on conversations with the attackers and party sources. That report says the attack was first spotted on September 9 and began with the compromise of a poorly protected WordPress site. It also claims the attackers gained persistent access to servers run by the hosting provider, which it identifies as AfD-owned Alternita Dienstleistungs GmbH, and exfiltrated more than a terabyte of data (The Register).

What is not confirmed:

• The Register states that no official sources have verified the attackers’ account of how the attack unfolded.
• The Register says it contacted Alternita Dienstleistungs for comment. The source does not report a response.
• AfD disputes the AI-generated summaries on the activist site. It has not commented on whether the raw files are authentic (The Register).

The source does not name any CVE, vulnerable software version or attacker identity.

Am I affected?

• You may be affected if your email address is among the more than 345,000 unique addresses reported as exposed (The Register).
• If you own one of the affected mailboxes, AfD says owners have been notified (The Register).
• Which specific accounts were copied is not confirmed.

What to do now

1. Check your address on Have I Been Pwned. The Register reports that the service has confirmed the scale of this breach (The Register).
2. If you received a notification from AfD as an account owner, follow it. The source does not describe what that notification contains.
3. As a general precaution, not drawn from the source, be wary of unexpected messages that reference content from the leaked correspondence.

Sources

• The Register: Attack on email hosting provider for German far right party AfD exposed 345k accounts