AfD leak: ZDF and OCCRP uncover swastika flag dispute in North Rhine-Westphalia

ZDF frontal and the OCCRP investigative network have published the first findings of their analysis of the leaked AfD emails. According to ZDFheute, the dataset contains more than 420,000 emails and over 50,000 attachments totalling about 300 gigabytes, including bank statements, donation records, meeting minutes and voice messages. Affected are the mailboxes of Leif-Erik Holm, Alexander Gauland, the party's federal arbitration court and its North Rhine-Westphalia branch. The AfD confirmed the leak, saying a hosting provider was attacked in September and parts of a few mailboxes, most unused for years, were copied.

The new reporting focuses on cases from North Rhine-Westphalia. In April 2025, members reported a fellow member who allegedly offered a swastika flag for sale at a party information stand. The man called the accusation defamation and left the party in early 2026 over unpaid dues; according to ZDF, a letter from the federal treasurer later invited him to apply for readmission once his debts were settled. A former local politician allegedly voiced violent fantasies about women who vote for the left; he has since left. In Aachen, a local chairman allegedly said in a voice message that people who destroy posters should be “impaled.”

Bundestag member Matthias Helferich also appears in the files: in a 2017 chat he called himself “the friendly face of National Socialism,” which he later described as irony. An attempt to expel him failed this year. At the same time, ZDF says fake emails that are not part of the dataset are circulating. The AfD called the data theft unlawful and said publication was under review. The hackers, who call themselves “Hexane,” say they are not state-funded, according to taz.