Anonymous Site Publishes AI Summaries of 421,000 Exposed AfD Emails

Germany’s Alternative für Deutschland party confirmed on October 19 that a hosting provider used for its communications was hacked in September. This admission followed the appearance of an anonymous online archive publishing summaries of hundreds of thousands of internal emails.

The party told Bild that attackers copied mailboxes during the September incident. By the time this confirmation was reported, the website hexane.cc had been online for hours. The site hosts an index claiming to contain 421,179 of the party’s internal messages.

View the original post on X

View the original post on X

Context of the Breach and Archive

International Cyber Digest, a cybersecurity news account on X, examined the hexane.cc site on October 19. The outlet reported that the index includes the mailbox of Gauland, the party’s honorary chairman. The newest message in the archive is dated September 12, 2026.

The website does not publish the original email texts. Instead, it displays summaries generated by artificial intelligence software. These summaries are sorted into categories including racism and antisemitism. Each entry receives a severity rating ranging from Low to Critical.

Discrepancies in Party Statements

The AfD provided a limited account of the security incident to Bild. The party asserted that attackers only copied parts of a few mailboxes, most of which had not been used for years. It claimed that leadership current accounts were not accessed.

However, the online index includes messages dated as recently as September 12, 2026. This timeline raises questions about the accuracy of the party’s statement regarding the scope of the breach. The presence of recent messages suggests active accounts may have been compromised.

Content and Verification Issues

According to summaries relayed by International Cyber Digest, the archive contains sensitive content. One entry describes Gauland forwarding a 2018 email about a “Hitler pilgrimage” by a former judge on the party’s internal court in Thuringia. Another summary mentions a district board member sending a Christmas card with a swastika and the words “Heil Hitler”.

A third summary details staff at the party’s Berlin headquarters discussing luring a photographer to an event and throwing him out by force. This thread was signed off with the phrase “hail and victory”. None of these summaries have been linked to an original email that can be verified.

The site operators have not identified the AI software used to create the summaries. When users attempt to open a record, the site displays the message “source text not published for this record”. This prevents independent verification of the content’s authenticity.

What should you do?

Organizations should monitor for unauthorized disclosures of internal communications. Security teams need to verify the scope of any hosting provider breaches. Leaders should prepare for potential misinformation campaigns using unverified summaries.

What to do and how to stay safe: AfD

• Monitor public archives and dark web forums for unauthorized disclosures of your organization’s data.
• Verify the scope of any third-party provider breaches by auditing access logs and mailbox activity.
• Develop a communication plan to address potential misinformation based on unverified or AI-summarized data.
• Ensure that inactive accounts are properly archived or disabled to reduce exposure in hosting breaches.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many emails were exposed in the AfD breach?

An anonymous site published summaries of 421,179 internal emails, according to the hexane.cc archive.

Did the AfD confirm the breach?

Yes, the party confirmed on October 19 that its hosting provider was hacked in September.

Are the original emails available to the public?

No, the site only provides AI-generated summaries and states that source text is not published.