Handelsblatt analyzed an archive with over 421,000 emails from 2013 to 2026 and checked numerous messages for authenticity.
Around 30,000 emails have a digital signature (DKIM) that the recipient server has noted as valid. The editorial team itself recalculated more than 16,000 of these signatures.
Emails written by Handelsblatt reporters themselves are particularly important: they prove the authenticity of individual messages.
When evaluating, the editorial team also relies on public documents such as Bundestag information on major donations and uses artificial intelligence to process the large amount of data.
Dusseldorf. On September 30, 2016, Handelsblatt reporter Dietmar Neuerer responded to an offer from the AfD at 1:08 p.m. The subject of the email was “Deutsche Bank – Inquiry Alice Weidel”. “We pass in this case,” Neuerer wrote to Christian Lüth, the party’s contact person at the time. And further: “However, an interview with Ms. Weidel would be interesting – with a view to the situation of the AfD and the election year of 2017.”
Ten years later, the email resurfaced in an archive with more than 421,000 internal AfD emails. Lüth forwarded it to Weidel that same evening. Neuerer looked for the email in his mailbox and found it. Date, time and wording match. For the editors, this is one of several clues that indicate that these are real emails.
“Hexane”: Archive without sender
The material is circulating under the name “Hexane”. It includes emails from the mailboxes of nine accounts from 2013 to 2026. There are also around 48,700 documents, 8,300 images and excerpts from the party's websites and its structures. An anonymous group distributes the package via its own website and via peer-to-peer sharing software - this allows computers to exchange files directly with each other without a central server storing or distributing all the data. It is still unknown who stole the data.
The AfD confirmed a hacker attack on a hosting service provider in September 2026. Parts of a few email inboxes were illegally copied. Most of them are outdated and current federal association accounts are not affected.
DKIM: Digital email signatures
Around 30,000 emails carry a digital signature (DKIM), which the recipient's server confirmed as valid at the time. This means that these emails come from the specified sender's mail server and have not been changed on the way to the recipient, at least according to the receiving server's note.
Check emails for authenticity
The Handelsblatt examined the material, using its own emails from back then and with a cryptographic check.
The editorial team also recalculated the digital signature (DKIM) for more than 16,000 emails themselves, using keys that can be accessed today. These emails come from a server in the specified domain and have not changed since they were sent. This particularly applies to emails from AfD servers from 2021 and from private providers such as web.de, GMX and Yahoo.
For the editorial team, emails that they have written themselves have the greatest weight. The archive contains 23 messages from Handelsblatt addresses, written by five senders. Most are from 2017 and went to Alice Weidel's office. It's about making appointments, accreditation and interview requests. 22 of these emails have an identifier assigned by a Handelsblatt mail server. Answers from the AfD to inquiries from the Handelsblatt from 2015 and 2016 can also be found in the archive.
Donations and court records
Another way to check is through processes that are publicly documented. Since the end of 2016, the Bundestag has published 13 major donations to the AfD. The Handelsblatt reported on some of these in February 2025, such as the donations from Gerhard Dingler, Horst Jan Winter and Winfried Stöcker.
If you donate over 100,000 euros, the process can be followed in the emails. The money was received on December 29, 2016. On January 4, 2017, the AfD reported the donation to the Bundestag administration. The data in the emails correspond to the official information.
AfD leak: Gaps in the material
The archive includes the mailboxes of nine identifiable individuals. The years are covered differently; the mailboxes of the Federal Treasury, for example, are completely missing.
It cannot be ruled out whether, apart from the 16,000 emails verified by the editorial team, others were subsequently changed. The editorial team therefore handles the content carefully: it does not rely solely on the archive, but rather looks for further evidence. Anyone who appears in reports will be confronted with the allegations and given the opportunity to comment.
More than 400,000 emails can hardly be evaluated by hand. That is why artificial intelligence is also used to analyze the material. Every text in the Handelsblatt that is created from the data set is still based on checking by editors who have read the relevant emails and documents in the original.
