Overview of the german afd email leak

Short answer: 421,178 emails. Each is a distinct message: the source
deduplicated the archive by Message-ID before release (their DATA_DICTIONARY.md),
and that holds. Only 42 emails share a Message-ID with another one,
and 81 have none. So “copies of the same email in several mailboxes” is
not a factor here: when two mailboxes held the same email, only one copy survived,
in one of the folders. (That matters in A2.)
The latest email is dated 14 September 2026. The website data (Part B)
reaches about three weeks further.

The mailboxes cover very different windows: Gauland’s runs 2017–2023,
bundesgeschaeftsstelle@ stops in early 2018, and the hyphenated Holm folder covers
just two weeks (A6). The 2016–2018 peak is mostly the bundesschiedsgericht@ folder, which
holds far more than the arbitration court’s mail (A2). An empty cell means the archive has no emails from that folder for that year.

Green links: delivered to the folder’s own namesake. Violet: delivered to someone else. Grey: no delivery header (the server didn’t record one) or smaller recipients folded into other. Hover a link for its count.

• 300,807 threads if every unanswered email counts as its own thread.
• 49,554 conversations if a thread needs at least two emails. These hold
  169,925 emails (40% of all).

84% of threads are a single email: newsletters, notifications, spam,
one-off messages nobody answered, or replies whose predecessor isn’t in the archive.Two signs that the mailboxes are incomplete:
63,718 threads (21%) cite at least one earlier email
that is not in the archive (98,919 missing emails in total,
e.g. the sent copy of a reply). And only 9,111 threads span more than one
mailbox folder, partly because of the Message-ID deduplication (A1).

• 51,998 of 421,178 emails (12%) carry a server
  verdict: 1,227 YES, 50,771 NO. Coverage depends on the mail server: 100% for
  the hyphenated Holm folder, under 1% for bundesschiedsgericht@.
• With the verdict hidden, the rules still catch 815 of the 1,227 server-YES
  emails (66%).
• They also call 2,036 server-NO emails spam (4% of them). A random
  sample (below) shows that these are spam the server missed.
• On the 369,180 emails with no verdict, the rules find 5,324 spam.

So the count of 8,618 spam emails is a conservative estimate:
the server flag alone gives a floor of 1,227, and the rules miss about a third of server-flagged spam,
so the true figure is likely somewhat higher. At about 2% of all emails, spam hardly changes the other numbers.

Advertisement

AfD and politics & state: who exactly?

Left (blue): the AfD. 221,769 emails come from party addresses, spread over 428
domains (the part of an address after the @) and 2,785 addresses. The chart shows the 10
domains that sent the most emails. Each bar is one domain. Its length and the number at its end
give how many emails from addresses at that domain are in the ten mailboxes. Together these 10
domains account for 85% of all AfD emails.
Right (orange): politics & state, meaning parliaments, other parties, government, courts and
police (8,770 emails), split by kind of sender. Here too, the number at each bar is the number
of emails.Bundestag mail (7,068 emails from 155 addresses) is concentrated: 90% comes from 15 addresses, which belong to markus.frohnmaier, leif-erik.holm, beatrix.vonstorch, enrico.komning, alice.weidel, michael.espendiller, anton.friesen and their staff (.maNN). These are AfD MPs, so most of Politics & state is AfD people writing from parliament accounts. Other parties barely appear as senders.

Each bar splits a category’s sender addresses by how many emails each one sent. Private persons mostly write once: 13,199 of 17,247 private addresses (77%) sent exactly one email, typically members of the public writing to the party. The AfD has few addresses, and each of them sends many emails. Almost every spam address sent a single email.

Short answer: 86% of
addresses form one connected cluster, held together by a handful of party addresses
that mail hundreds or thousands of others. Most edges are one-directional:
only 13% of sender→recipient pairs ever wrote back. The other
5,087 small clusters are mostly isolated pairs (4,415 of them):
one outside address and one recipient that never connect to anyone else.

Read a row as this kind of sender, a column as writes to this kind of recipient. A delivery is one
(email, recipient) pair, so one email to 100 recipients counts 100 times. Mass mailers therefore weigh heavily:

• AfD → AfD is the biggest block: internal mail and party mailing lists.
• Private persons → Politics (10%) is mostly people mailing whole parliaments: the 10
  busiest private senders account for 34% of it, and 25% of all deliveries by private senders.
• The same goes for Companies → Companies: the largest single sender in the archive, musik-baron.de, sent
  ~1,900 emails to ~100 recipients each (party addresses, MPs, media).

Emails in both directions show that an exchange took place. Only a minority of private persons and companies ever got a reply in the archive. (Replies sent from addresses or mailboxes outside the archive are invisible here, so this is a lower bound.)

Two clusters dominate. On one side NRW (state office, arbitration court, Jacobi’s three addresses, the state board), linked to the MV office (7, 16) and the fan shop (5, 6). On the other, the federal party around Gauland and Weidel (17, 11), surrounded by private and company mass mailers who write to them and to MPs of all parties (the large green dot, no. 1, is one such sender). Not shown: PayPal’s notifications to paypal@alternativefuer.de, which form a separate island. Private persons are not named: they are listed by their mail provider only, and those writing from their own domain as own domain, without it (the sender rules count such domains as companies; here they are shown as private persons).

4,283 emails (1.0%) have no readable text. Most of them are not broken:
3,513 consist only of attachments (a PDF, a scan, a calendar invitation),
281 are automatic read receipts, and in 230 Outlook packed the text into a
winmail.dat attachment. 132 have an HTML part without any text (typically a
newsletter made of images), 67 are encrypted, and only 60 are
completely empty.
No folder stands out: the share lies between 0.2% and 2.0% (schiedsgericht@). These emails still
count in every number that is based on headers.

What is DKIM? A digital signature that the sender’s mail server attaches to an email when sending it; if the text or one of the signed headers (such as sender, subject or date) is changed afterwards, the signature no longer matches.100,929 emails (24%) carry a DKIM signature. The share varies by year,
from 11% (2018) to 44% (2026). (56 emails could not be
parsed by the verifier; they count as unsigned.)
What the signatures say today:

• 27,120 verify completely: text, headers and the sender’s key, which is still published.
• 7,628 are mathematically intact, but expired or made with the outdated SHA-1.
• 20,993 have an unchanged text, but the sender’s domain no longer publishes the
  key, so the header part can’t be checked. That is normal for old mail: keys get replaced.
• 11,204 have an unchanged text, but the header check fails. Either a
  header line was changed on the way (mail gateways tag subjects, for example), or the
  domain has since published a new key under the same name.
• 33,805 have a text that no longer matches what the sender signed. This
  check needs no key, so it is reliable for old mail too.

A broken signature doesn’t prove a forgery. An intact one only shows that the text is what
the sending server signed; whether the content is true is a separate question.

Were emails edited? The changed texts follow a technical pattern.
31,690 of the 33,805 emails with a changed text (94%) are in one folder,
bundesschiedsgericht@. There, 92% of all signed emails from Feb 2015 to 17 September 2019 are
affected, from every kind of sender (PayPal receipts, Gmail, Twitter …). Then it stops from
one day to the next: of the 1,397 signed emails after that date, 1 is
affected. The folder’s volume drops sharply at the same time. In all other folders, 3.3%
of the signed emails have a changed text, with no comparable cluster.
Hand edits would affect a few selected emails; here almost every PayPal receipt of a month is affected. The
pattern fits software that re-encoded the stored emails, for example when the mailbox was
moved to another system. A separate check of 200 changed and 200 intact emails from this
folder (not part of this analysis) supports that: 171 of the changed ones contain base64
blocks wrapped uniformly at 76 characters, against 85 of the intact ones. In the same check,
appended or prepended text, line endings and mbox >From quoting explained none of the changes.

Read from the outputs of the same log:

• Passwords from the web server. The configuration files of every site on the machine are read,
  including database passwords.
• The mail-management system answers. The internal app behind mail-management.afd.de is read
  from disk; with a key found there, its API first refuses (HTTP 401), then returns data (HTTP 200).
  Around 16:30 a list of all mail users (≈0.9 MB) is downloaded and turned into a mailbox table.
  The archive’s mailbox-management table (000678_mm_mailboxes.tsv) is the same kind of record.
• Mail-server logins work for a system account (no-reply@…) on three mail hosts.
• The direct route fails. For two hours there are attempts to mount the mail storage
  (NFS_…_MAIL_BACKEND) from the web server; every attempt is refused.
• Not visible in this log: the WP-Console plugin (it is also not among the site’s active plugins
  in its exported settings), and the changing of mailbox passwords. Both may have happened outside
  this one session, which covers only 201 commands on one afternoon.

A second record cross-checks the article’s hour. The archive also holds the mailbox table of the
mail-management system (000678_mm_mailboxes.tsv, 2,219 mailboxes; the password column is not read here).
It shows 6 new mailboxes on 14 September between 04:24 and
04:27 UTC (06:24–06:27
German time), each noted as “Backup-Account von …@afd.nrw”. One of them is the backup of
fabian.jacobi@afd.nrw, whose mailbox is in the archive. The table doesn’t say who created them, or why.
The timing fits the article’s “detected around 6 a.m.”. The table’s newest change is from
08:47 UTC that morning, so this copy was made after the detection.
Password changes, checked: 9 of the leaked mailbox folders appear in this table
(the dotted leif.erik.holm@ doesn’t: it is no mailbox of its own, which fits A2).
Only 1 of them changed in September 2026 (schiedsgericht@afd.nrw at 05:24 UTC on 14 Sep), after the detection.
The table keeps only the latest change per mailbox, so earlier changes could be overwritten, but for the
untouched ones there is no sign of a password change through this system. If passwords were changed,
it happened somewhere this table doesn’t record.

All 139 leaked websites (one row per distinct domain, grouped by site type; counts are distinct records in the leaked database, as in B2). Scroll the list; links open the live site.

State associations (Bavaria, Saxony-Anhalt, Thuringia) and the party newspaper AfD Kompakt hold the most submissions; in.afdbayern.de (by its name, the Bavarian party’s internal site) has by far the most accounts (477). The admin log column shows that many sites recorded every admin login and edit, with IP address. Sent-mail logs stop at exactly 250 on most sites: the logging plugin keeps only the latest ones.

The curve is flat (a few hundred to a few thousand a month) except for bursts: single days on which
one form received 500+ submissions. There are 11 such days, holding 42,166
submissions (21% of all since 2017). The two big ones are on www.afd.de, where a normal day
brings 20–150 submissions.
What they are can’t be told from these tables: a bot flood, a mass import or a coordinated campaign all look the
same. The IP addresses don’t settle it for www.afd.de, which records only a handful of distinct IPs on every day
(probably a proxy). On sites that record real visitor IPs, bursts from 1–3 IPs (e.g. afd-lsa.de, afdbayern.de) are
most likely automated. The number of form submissions is therefore not a number of people.

Most databases were copied in September/October 2026. The newest entry in each database shows
this: a copy can’t contain entries made after it was taken. For 106 of 138 sites the newest entry is
from September or October 2026, so these databases were copied in those weeks, the last one on 5 October 2026.
The other sites have an older newest entry. That doesn’t necessarily mean they were copied earlier: either
nothing happened on the site for a while, or the copy came from an older backup. For comparison, the newest
email in the archive is from 14 September 2026.

Blue = original data taken from a system (290 GB, 98,917 files). Orange = made by the source, including some mixed working folders that also hold copied server files (11.0 GB, 2,050 files). Grey = public API snapshots and a public password list. By size, the source’s material is small compared with the email; by file count it is large. It also includes the personal-data lists described below.

What the source built on top of the website databases (grouping by file name; counts inside the
files are the source’s):

• Ready-made personal-data lists. 119 *.gf_named.tsv files match every form answer to its field
  label and class (email, first/last name, phone, city, member number, birth date). 226 more TSVs sweep
  every table of every site for anything that looks like personal data (362,398 rows, mostly noise).
  000072_inf6_identities.tsv lists 6.65 million identifiers (IPs, emails, phones). For www.afd.de, a
  separate bundle in 02_DATABASES/ holds extracted emails (86,237), phone numbers, names and addresses.
• Triage. Keyword searches, category labels such as cat_illegal_activity, reading queues
  (MAIL_QUEUE_V2.tsv, 2.7 GB) and language-model scores. The briefing’s “key findings” come from here:
  ~263,000 keyword-ranked records → 490 scored by a model → 136 rated high/critical → hand-checked sample.
• Records of the access. Probe results, download lists, credential-reuse tests and a ledger
  of server access.

These lists contain nothing that isn’t already in the original tables. With them, contact details
can be collected in bulk without any database queries.