In September 2026 a hosting provider used by Alternative für Deutschland (AfD), a German political party, was breached. Have I Been Pwned later recorded 345,400 unique email addresses from the incident. The politics are beside the point for this analysis. What matters for every party, NGO, union and campaign group is that political-opinion data is a GDPR Article 9 special category, that processor and controller duties diverge sharply on who notifies whom, and that most organisations still run political mail on infrastructure that would fail a basic Art. 32 test.
Applies to: any organisation that processes membership, donor, volunteer or campaign email under EU GDPR or UK GDPR — parties, NGOs, unions, charities and advocacy groups worldwide with an EU or UK nexus. Not legal advice.
What is publicly established
On 20 October 2026 the AfD federal party stated (opens in a new tab) that a hacker attack on “a hosting provider of” the party had occurred at the end of September 2026, that the stolen data had since been made accessible via an activist website, that “only a few mailboxes were unlawfully copied” but “large volumes of data” had flowed out, that mailbox owners and “die Datenschutzbeauftragte” (the data-protection commissioner) had been informed promptly, and that the party had reported the attack and the publication to the security authorities. A follow-up statement (opens in a new tab) on 21 October said the party would not assist media inquiries seeking to authenticate leak content.
Tagesschau (opens in a new tab) (ARD, 20 October 2026) reported the party’s confirmation, quoted the September timing and the claim that most affected mailboxes had not been in active use, and identified the affected company as Alternita, a party-owned undertaking, with access reported to mail of the North Rhine-Westphalia and Mecklenburg-Vorpommern state associations among others. The Federal Office for Information Security (BSI) told tagesschau it was in contact with the party.
Have I Been Pwned (opens in a new tab) added the breach on 27 October 2026 as a sensitive breach affecting 345.4k unique email addresses (email addresses and email messages), citing the party’s disclosure and subsequent reporting that identified Alternita Dienstleistungs GmbH. The Register (opens in a new tab) (Connor Jones, 27 October 2026) reported the HIBP confirmation and the party’s statement; credit and link as required. Claims about the initial attack path — a poorly protected WordPress instance and subsequent persistence, as reported by journalist Lilith Wittmann citing attackers and party-adjacent sources — have not been verified by official primary sources. This article does not rely on them for any operative conclusion.
Company registers and Alternita’s Impressum (opens in a new tab) list Alternita Dienstleistungs GmbH with its seat in Berlin (Amtsgericht Charlottenburg, HRB 235908 B). That seat matters for supervisory jurisdiction, below.
Political opinions are an Article 9 special category
Article 9(1) GDPR prohibits processing of personal data “revealing … political opinions”, among other special categories, unless a paragraph 2 exception applies. The authoritative English text is Regulation (EU) 2016/679 (opens in a new tab) (CELEX 32016R0679). Recital 56 expressly contemplates processing of political opinions by parties under conditions of Union or Member State law.
For a party, NGO, union or campaign group the workhorse exception is usually Art. 9(2)(d): processing in the course of legitimate activities with appropriate safeguards by a not-for-profit body with a political, philosophical, religious or trade-union aim, limited to members, former members or persons in regular contact with the body in connection with its purposes, and not disclosed outside the body without the data subject’s consent. Explicit consent (Art. 9(2)(a)) is a poor fit for historic mail archives. Legal claims (Art. 9(2)(f)) are narrow and usually post-incident.
Why this raises the security bar: Art. 32 requires technical and organisational measures “appropriate to the risk”. Special-category data about political opinions, sitting in years of mail and attachments, is high-risk processing. A shared WordPress estate, weak admin MFA, or a party-owned host without a real Art. 28 contract is not “appropriate” merely because the organisation is small or volunteer-run.
Controller versus processor: who notifies whom
Under Art. 4, the controller determines the purposes and means of processing; the processor processes on the controller’s behalf. For political mail, the party or NGO is typically the controller. A mail-hosting company — including a party-owned services GmbH — is typically a processor, unless it starts deciding purposes and means, in which case Art. 28(10) makes it a controller for that processing.
Art. 28 requires a binding contract: documented instructions only; confidentiality; Art. 32 security; sub-processor rules; assistance with data-subject rights and with Arts 32–36; deletion or return at the end; and audit support. Art. 32 binds both controller and processor to security appropriate to the risk.
On breach notification the split is sharp:
- Art. 33(2): the processor notifies the controller without undue delay after becoming aware of a personal data breach.
- Art. 33(1): the controller notifies the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to rights and freedoms. Late notifications need reasons. The content of the notice is set out in Art. 33(3); documentation is required by Art. 33(5).
- Art. 34: if the breach is likely to result in a high risk, the controller communicates it to data subjects without undue delay, subject to the Art. 34(3) exceptions (effective encryption, subsequent mitigation, or disproportionate effort replaced by public communication).
A party-owned host does not dissolve these roles. If Alternita processes mail on behalf of the federal party or state associations, someone must still be able to show an Art. 28 contract, an Art. 33(2) notice path into the controller, and an Art. 33(1)/34 decision by the controller. “We own the GmbH” is not a GDPR answer.
Which German supervisory authority?
Germany’s supervisory system is federal. The Conference of Independent Federal and State Data Protection Supervisory Authorities (DSK), in its 5 September 2018 decision (opens in a new tab) on parliaments, parliamentary groups, members and political parties, states plainly that parties as non-public bodies are addressees of the GDPR and fall under the supervision of the supervisory authorities. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) limits its own remit (opens in a new tab) to federal public bodies, certain financial authorities, and — for private bodies — specified telecoms/postal and security-vetting contexts. Ordinary private companies, associations and parties are supervised by the Land data-protection authorities.
For a Berlin-seated processor such as Alternita Dienstleistungs GmbH, the natural competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI). For the federal party as controller, the Land of the main establishment / the place where decisions on purposes and means are taken will ordinarily lead; federal party operations are Berlin-centred, so Berlin is again the practical starting point, without prejudice to Land DPAs where state associations are separate controllers for their own processing. The party’s reference to informing “die Datenschutzbeauftragte” (feminine singular) is consistent with notification to a state commissioner; we have not seen a published BlnBDI case file on this incident as of 29 October 2026.
Do not assume BfDI jurisdiction merely because the victim is a federal political party. Under the DSK position and BfDI’s own published remit, that assumption is wrong for ordinary party processing.
What any political organisation should demand of its mail host
- A written Art. 28 contract that names special-category data, sub-processors and audit rights.
- A security baseline commensurate with Art. 9: MFA on every admin path, hardened CMS, patch SLAs, encryption in transit and at rest, and segregation of political mail from marketing or campaign WordPress estates.
- A contractual duty on the processor to notify you without undue delay, with Art. 33(3)-shaped fields, so you can meet the 72-hour SA clock.
- A clear map of who is controller and who is processor when the “host” is a party-owned affiliate — ownership does not merge the roles.
- Log retention, forensic access and exit assistance written down before the incident.
- The competent supervisory authority named in the DPIA for Art. 9 processing.
- A ban on silent secondary use of mailbox content (analytics, model training, enrichment) without a fresh lawful basis.
- A tested restore and compartmentation plan so one compromised CMS cannot open every mailbox.
Beyond Germany
UK GDPR Article 9 mirrors the special-category list, including political opinions; the Information Commissioner’s Office is the UK supervisory authority, and the Data Protection Act 2018 Schedule 1 sets additional conditions for processing. Breach notification to the ICO follows the same “without undue delay / 72 hours where feasible” structure as Art. 33. EU Member States apply Art. 9 directly, with national DPAs and, for cross-border processing, the one-stop-shop lead authority rules. In the United States there is no federal GDPR equivalent; political committees face election-law and state privacy overlays that must be checked state by state — do not import Art. 9 language into a US brief without local counsel.
The practical constant does not change with the flag. Treat political mail as sensitive. Contract the host as a processor. Rehearse the 72-hour clock. Separate campaign CMS from mailbox infrastructure. The AfD incident is a German fact pattern; the governance failure it illustrates is not.
Primary sources: AfD statements 20–21 October 2026; tagesschau 20 October 2026; HIBP AfD breach record; Alternita Impressum (Berlin, HRB 235908 B); DSK decision 5 September 2018; BfDI jurisdiction page; Regulation (EU) 2016/679 (EUR-Lex ELI / CELEX 32016R0679) Arts 9, 28, 32, 33, 34. Secondary credit: The Register, 27 October 2026; gdpr-info.eu as article mirror only. Unverified and excluded from operative claims: attacker-described WordPress initial access path.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)