Download
← All fact checksMorning run · October 21, 2026 · #4 by reach
PoliticsTechnologyEvent claim

Did a leak site publish internal emails from Germany's AfD?

Did a hacker leak 421,179 internal emails from Germany's AfD, including ex-leader Alexander Gauland's mailbox, and does the leak site show the real emails or only AI-written summaries?

True, but…

The leak site provided AI-generated summaries, not full emails.

An anonymous archive claimed to publish 421,179 internal emails from Germany's AfD, but it provided AI-generated summaries instead of full texts.

+3Sources ↓Original post ↗
Likely genuine
The post as it circulated, labelled by our media check.Image

Claims

✓ 4 true

A leak site published 421.179 internal emails from Germany's far-right AfD.123

~ Partly trueCentral claimHigh confidence

Multiple reputable sources indicate that the site indeed published an index claiming to contain 421,179 emails from the AfD. However, the primary content displayed consists of AI-generated summaries rather than the original emails. This distinction is crucial: while the claim about the index is true, the nature of the content is misleading without the clarification of it being summaries only. Reputable outlets, including Security Affairs and YAC News, have corroborated these points, adding layers of scrutiny regarding the reliability of the published content.

The published material includes the mailbox of ex-leader Alexander Gauland.12

✓ Likely trueHigh confidence

The index reportedly lists Alexander Gauland's mailbox as part of the leaked emails. This assertion is supported by multiple sources, including both ICD and news outlets such as Bild. However, concrete confirmation from the AfD about this specific mailbox has not been publicly detailed. They have acknowledged a cyber breach but have not fully enumerated affected accounts. Thus, while this claim is likely true, it lacks independent verification directly from the implicated party.

ICD found the site shows AI-written summaries, not the emails.12

✓ TrueHigh confidence

International Cyber Digest (ICD) and multiple news outlets confirm that the archive primarily provides AI-generated summaries and that common attempts to access the full texts reveal messages indicating those records are not published. This clarity is vital to understanding the actual content being offered by the site. It reflects a broader context about content integrity and manipulation, particularly regarding sensitive information.

The newest indexed message is dated 12 September (2026).12

✓ Likely trueModerate confidence

The report cites ICD's findings indicating some indexed messages date as recent as September 12, 2026. While this aligns with the claims made about the leak, independent checks haven't confirmed each dated message. The AfD confirmed an attack in September but has provided limited details, which means this specific date relies heavily on the information from the index rather than direct validation.

The archive's own index file names a server "afd_exfil".12

✓ Likely trueModerate confidence

Various reports and technical analyses have noted that the filenames in the archive indicate a server labeled "afd_exfil." This aligns with naming conventions typically associated with data exfiltration. Therefore, while this information appears credible, definitive authentication directly linked to the server itself has not been fully disclosed.

What was posted

X

An anonymous site claimed to have leaked 421,179 internal emails from Germany's far-right AfD. The post indicated that summaries, not the full emails, were displayed.

“‼️BREAKING: A leak site published 421.179 internal emails from Germany's far-right AfD, including the mailbox of ex-leader Alexander Gauland. ICD found it shows AI-written summaries, not the emails. The newest is from 12 September. Its own index file names a server "afd_exfil".”

“‼️BREAKING: A leak site published 421,179 internal emails from Germany's far-right AfD, including the mailbox of ex-leader Alexander Gauland. ICD found it shows AI-written summaries, not the emails. The newest is from 12 September. Its own index file names a server "afd_exfil".” — translated

Who posted it

X
@IntCyberDigest

Account under a year old

View the account on X ↗

Account check

Looks like a genuine account20%
Likelihood of automation80%

Estimates from public signals — account age, posting pattern, audience — not a judgement of the person behind the account, and separate from whether this post is true.

What stood out

  • No verifiable information found about the account 'IntCyberDigest'.
  • Account lacks a display name, bio, and recent posts, which are typical for inactive or automated accounts.
  • No evidence of platform verification or notable news coverage associated with this account.
Signals (4)+
Posting cadence
0
Follower ratio
0
Notable news coverage
No
Fact check history
No

Account checked October 21, 2026, 02:59 UTC

The media

Image
Likely genuinePresented as real footage

✓ What is genuine

The image is a routine graphic carrying the AfD logo, not direct evidence of the claims made.

The tells

  • ●●● Strong signal The image is branded with AfD insignia.our visual review
  • ●●● Strong signal The graphic serves an illustrative purpose in the context of the post.our visual review

Synthetic-media detector

Detector not consulted

The media is incidental to the claim; the detector was not needed.

Sources

6 sources reviewed

Further reading

  • 1Security Affairs Provides details on the index and context about the email summaries.
  • 2YAC News Summarizes reporting related to the index, including specific names like Gauland.
  • 4Euronews (AFP) Offers context about the hack and discusses affected parties.

The full story

On October 19, 2026, an anonymous archive, reported as hexane.cc, claimed to have published an index of 421,179 internal emails from Germany's far-right AfD party. The site promised substantial downloadable content while only providing AI-generated summaries rather than the full emails. The summaries include severity tags but do not release the raw texts, leading to considerable concern about the authenticity of the claims made within these summaries. The AfD confirmed the existence of a cyberattack targeting a hosting provider, verifying that the breach did occur, though they did not provide comprehensive details about affected accounts or the extent of the data taken. Independent checks by various media and cybersecurity researchers show a lack of full access to the original emails. As of now, only limited samples from the cited archives have undergone independent investigation, meaning much of the content presented remains unverifiable at this stage.

Kernel of truth

While the claim about the AfD emails feels credible, it is primarily based on an index and AI summaries rather than authentic documents.

How it was framed

False context

The claim about the email leak is authentic but lacks context about the nature of the content, which dramatically shifts the interpretation.

  • Urgency. The use of 'BREAKING' signals a need for immediate attention.
  • Emotional language. Terms like 'leak' and 'internal emails' evoke strong reactions around data privacy.

Bias

NoneSlightModerateStrong

The post is a breaking-report notice from a cybersecurity account; it highlights incriminating material about the AfD but largely relays observations from the archive rather than advancing an ideological argument.

Bias describes how the post frames its message — the slant of the language, selection and emphasis — and is judged separately from whether the claim is true. A true claim can still be framed with a strong slant.

How we checked

1 min 10 s
  1. 1

    Searched for reports on the AfD leak and the website hexane.cc.

  2. 2

    Checked multiple news sources corroborating details about the claimed email breach.

  3. 3

    Examined independent findings stemming from the claimed events.

✓ Claim checked✓ Media checked✓ Sources checked

Why 85% confidence

High

The high confidence band is supported by multiple corroborating sources confirming the core claims but recognizing caveats surrounding the nature of the published content.

Limits. Limited access to the original emails means full verification could not be asserted.

What we don’t know

  • What specific emails have potentially been accessed in the breach.
  • The full extent of the cyberattack that impacted the AfD.
  • Whether any further details of the breach will be made public by the AfD.

Spot it yourself

Find the overstatement

Looks suspicious, isn’t proof

  • The claim centers on a breach of privacy that feels alarming.
  • Language suggesting urgency can exaggerate the importance of the findings.
  • Usage of AI-generated terms can mislead regarding the reliability of the information.
  • The source of the information is anonymous.

The actual evidence

  • Independent news outlets confirm the existence of an index claiming 421,179 emails.
  • AI-generated summaries displayed rather than actual emails corroborate claims.
  • Acknowledgment of a September data breach by the AfD supports the context of the claims.
  1. 1

    Look for information from reputable news sources.

    Cross-check claims against multiple established outlets.

  2. 2

    Investigate any anonymous sources critically.

    Determine the reliability of claims made by public accounts.

  3. 3

    Examine the type of content shared.

    Assess if the claims are based on original documents or summaries.

Takeaway

Be cautious with claims presented in a sensational format, as they can distort the actual nature of the information offered.

Questions people ask

What is hexane.cc?+

Hexane.cc is reported as an anonymous archive claiming to have published a large number of emails purportedly from the AfD, though it primarily shows AI-generated summaries.

Why are AI-generated summaries concerning?+

AI-generated summaries may misrepresent the original intent or context of documents, leading to misconceptions about the content's authenticity.

Has the AfD verified the claims of a data breach?+

The AfD confirmed that a cyberattack occurred in September 2026, but has not detailed all the accounts or data that were compromised.

What does 'likely authentic' mean in this context?+

It implies that while elements of the claim are corroborated, they are grounded on confirmed reports rather than direct access to the original texts.

How can I verify similar claims in the future?+

Check for corroboration from multiple independent news outlets, assess the content type shared, and scrutinize the source of the claims.

Go deeper

Data Breach
An incident where unauthorized access to confidential data occurs.
AI-generated Summaries
Text summaries produced by artificial intelligence algorithms rather than written by humans.
Cyberattack
An attempt by hackers to damage or disrupt computer systems or networks.

People also search for

AfD email leak October 2026421,179 AfD emails summary leakhexane.cc AfD email archive
For educators+
How bias can impact the interpretation of information.The importance of source validation in journalism.Understanding data privacy issues in the digital age.
  • What role does sensationalism play in shaping public perception of data breaches?
  • How can one distinguish between accurate reporting and misinformation in technology-related news?
  • What are the implications of AI-generated content in journalism?

About this check

Platform
X
Posted by
@IntCyberDigest
Posted
October 19, 2026
Age when checked
1–2 days old when checked
Where it spread
Germany
Audience
UK & EU audience
Language
EN
Status
● Post is live
Verified
October 21, 2026, 03:01 UTC
Published
October 21, 2026, 03:01 UTC

Reach. Follow-up ICD post on Gauland 'Hitler pilgrimage' email has 9,300 likes (syndication); covered by Handelsblatt, Tagesspiegel/dpa, t-online, OKO.press on 20 Oct; AfD confirms a September hack of a hosting provider.

This verdict was generated with AI from the sources shown. AI can make mistakes — check the sources before relying on it.

Check anything yourself, in seconds.

Share any social post or video to What the Fact and get the verdict, the confidence, and the receipts.

Download on theApp StoreGet it onGoogle Play