AfD-Leak: „Gravierende Verstöße“ – AfD drohen nach Datenleck Millionenbußgelder

AfD politician Alexander Tschich attempted to obtain names and addresses of young eligible voters for targeted election campaigning ahead of the Mecklenburg-Vorpommern state elections. A mass email sent on July 16 to nearly all registration offices, some of which transmitted thousands of personal data sets without password protection.

The information is contained in a large AfD leak analyzed by the Handelsblatt. The Landesverband confirmed the incident. Responsibility for the inadequate protection was denied by the party. Mecklenburg-Vorpommern's data privacy officer Sebastian Schmidt initiated several verification procedures, checking if officials might have violated the data protection law.

One specific case involved an authority that had transmitted full birth data to the AfD. According to former Baden-Württemberg's data privacy officer Stefan Brink, this could lead to significant fines, as it poses a high risk to individuals, including unwanted visits to their homes, fraud, and deception risks. The Handelsblatt has been evaluating the leak's material for several days.

The technical details fit a regular dispatch through the AfD mail system. Additionally, press inquiries from the Handelsblatt found in the leak could be confirmed through a cross-check. The AfD federation confirmed a hacking attack on a hosting service provider in September 2026, where parts of a few mail folders were unlawfully copied, but most accounts were outdated and not affected by the current AfD accounts.

Around 421,000 emails were published, approximately 5,480 data sets were sent to the AfD from the eight identified authorities, amounting to a total of 274.05 euros. Seven of the eight authorities sent the information without password protection. Particularly concerning is an authority that sent an unencrypted PDF file containing names, addresses, and birth data.

The reimbursement of 594 data sets was deemed unlawful by Schmidt, as the Federal Data Protection Act explicitly forbids such transfers. Brink emphasizes the severity of the violations against data protection, calling it "grave violations." Other authorities were more cautious. One voter registration office sent Tschich a securely encrypted address file, providing the password afterward.

The Bundesdatenschutzgesetz allows for the transmission of names and addresses of certain age groups to parties within six months before an election, but the data must be deleted a month after the election. It remains unclear whether all data protection rules were followed during the transmission. Schmidt stated that both the receiving and transmitting parties are legally responsible for handling the data.

The AfD claims responsibility for the mailing, stating they were merely the requestor, and they deleted the mailing addresses after the election.