In response to a request from the Handelsblatt, the Stralendorf office in Mecklenburg-Western Pomerania confirmed that, in addition to names and addresses, they had also sent complete dates of birth by email to the state association of the AfD. “The date of birth was transmitted incorrectly and therefore represents a data protection violation,” explained the administration. The breach was reported to the data protection supervisory authority “immediately after it became known” and the persons affected were informed in writing.
The Handelsblatt had discovered that at least eight registration authorities in Mecklenburg-Western Pomerania had sent around 5,480 data sets containing the personal information of young voters to the AfD before the state elections in September. Seven of the eight authorities sent the data without additional password protection. The information was later found in an extensive data leak by the federal party.
Unidentified people published more than 420,000 emails as a result of the leak in mid-October. The AfD confirmed a hacker attack on a service provider in September. The regional association also confirmed a data leak. As a result, “personal and confidential information also became publicly accessible.” Citizens whose registration data authorities have sent to the state association for election advertising are also affected.
Handelsblatt is currently evaluating the leak material. The technical information corresponds to regular shipping via the AfD mail system. What also supports its authenticity is that the leak also contains press inquiries from the Handelsblatt, which were confirmed by a comparison.
The authorities released the data at the request of AfD politician Alexander Tschich. He had requested names and addresses of young voters for election advertising. The Federal Registration Act allows registration authorities, under certain conditions, to provide parties with names and addresses of certain age groups within six months before an election. The data must be deleted one month after the election.
According to the administration, the Stralendorf office sent 595 data sets with first and last names, full addresses and dates of birth. The information was sent in an unencrypted PDF file to the AfD state association's email address. The office explained whether the data sets had also been published on the Internet “cannot yet be conclusively assessed.”
According to the assessment of the state data protection officer in Mecklenburg-Western Pomerania, the transmission of birth data was inadmissible. “No, registration authorities are not allowed to do that,” said Sebastian Schmidt. The Federal Registration Act expressly excludes such disclosure. An investigation was therefore initiated against the office.
The Stralendorf administration is now warning that criminals could use the information to specifically contact citizens and steal further data. “So-called phishing attempts could give the impression that they come from the responsible registration authorities and therefore appear extremely authentic,” she explained.
Other municipalities also responded to the Handelsblatt research. The municipality of Süderholz, which transmitted 222 data sets without password protection, said it informed the data protection supervisory authority. “We take this incident very seriously,” Mayor Alexander Benkert told Handelsblatt. “Specifications regarding the data protection-compliant sending of reporting data were specified and employees were sensitized.”
However, Benkert also pointed out that the protection of reporting data at the data recipient is beyond “our sphere of influence”. “In the future, however, the recipients will receive appropriate information from us regarding their obligations when shipping.”
The city of Waren (Müritz) considers its current approach to sending registration data to be justifiable. She confirmed that she had transmitted 1,128 registration records to the AfD. The administration did not provide additional password protection. “The city has chosen so-called transport encryption,” explained the press office.
The city referred to a decision by the Hanover Administrative Court, which recognized transport encryption when transmitting personal data as “sufficient security”. Such encryption secures the transmission between the mail servers involved. The administration now wants to check whether the internal data protection regulations have been adhered to. It also needs to be clarified how the hackers obtained the data, how it was stored at the AfD and which IT systems were affected.
The city of Torgelow confirmed AfD politician Tschich's request from July 16th. He stated that he would use the information “exclusively for postal election advertising for the 2026 state election” and would delete it no later than one month after the election.
