Lilith Wittmann reconstructs (in German) how about 300 GB left Alternita, the party-owned provider that runs more than 300 AfD domains.
According to the hackers and the provider’s circle, the way in was a poorly protected WordPress at wahlkampf.afd.de, where they installed a plugin (WP-Console) for a shell; they reset officials’ mailbox passwords and pulled mail out via one-click hosters and IMAP batch requests.
The intrusion was noticed on 9 September after about 180 GB, but by the hackers’ account the code they left behind was not, and they came back on 14 September for another 120 GB.
The AfD’s own statement dates the attack to late September and blames the scandals on a crude AI keyword search.
The dump includes member-database extracts and register-office data on first-time voters in Mecklenburg-Vorpommern, which registry offices had emailed unencrypted, and the party’s claim that it informed the data-protection authority immediately sits awkwardly with the Berlin authority logging the report at 18:59, two hours after the 16:51 press release.
