Hexane’s AfD Dump: Assessing the Actor, the Scope, and the Access

What should investigators make of the Hexane AfD dump — the actor who published it, the archive’s scope, and the access that made it possible?

Treat it as a three-part assessment. The actor is Hexane: a sophisticated, privacy-focused cyber operator that stood up a purpose-built, anonymized, one-time-dump stack — Cloudflare-fronted domain, cock.li contact plus PGP, Monero-only donations, BitTorrent and a Distributed Denial of Secrets mirror — engineered to resist attribution and takedown. The scope is a 281 GB primary-source archive: Hexane’s MANIFEST.tsv lists 301,876,945,879 bytes across 102,985 files, and Hexane’s own briefing counts about 421,000 messages across ten mailboxes. The access looks like more than a few dusty inboxes. Attackers said they entered through an “outdated website”; heise online reported several web servers and at least one mail server as the source; and the corpus includes SQL dumps plus a credentials-and-keys trove that implies deep system reach.

The Actor: A Privacy-Focused Cyber Operator

Hexane did not leave a face, a company, or a press officer. What it left is posture.

On its About page, Hexane titled the project “An archive of internal records” and wrote that hexane.cc “publishes organisational documents, internal correspondence and administrative records that are in the public interest.” The archive, it said, “exists so that journalists, researchers and members of the public can examine primary material directly rather than rely on second-hand summaries.” It grouped records into five classes — correspondence, mailboxes, documents, databases, sensitive records — each with a severity from low to critical that “describes the substance of the content, not the prominence of anyone named in it.” Near-identical items were collapsed. Material with “no public-interest value” — routine invoices, templates, automated noise — was withheld from the browsable index.

That is a publisher’s self-presentation, not a confession of identity. The infrastructure around it is where the sophistication shows.

What Is the Purpose-Built One-Time-Dump Stack?

Read the stack as a deliberate anti-attribution, anti-takedown design.

• Domain fronted by Cloudflare. Live DNS for hexane.cc resolves to Cloudflare anycast addresses (including 172.67.212.198 and 104.21.61.183), nameservers keaton.ns.cloudflare.com and lia.ns.cloudflare.com, and Cloudflare MX hosts. That hides origin IPs and absorbs floods. Hexane told reporters they were hit with a DDoS and offered money to take the site down, heise online reported.
• Privacy contact only. Media contact is hexanedotcc@cock.li, with a PGP fingerprint Hexane published “exclusively” for contact and media enquiries — and explicitly not for signing documents, releases or torrents. “A signature from it should not be read as authentication of any file,” Hexane wrote.
• Monero-only funding. DONATE.txt in the corpus asks for Monero and routes other coins through a Trocador AnonPay link — privacy coin first, no advertising, “no sponsor.”
• Decentralized distribution. The corpus ships as BitTorrent plus magnet links and a DDoSecrets mirror at data.ddosecrets.org/Hexane/hexane-corpus/. That is how a one-time dump outlives its own website. Deutsche Welle reported the hosting site offline by Tuesday afternoon on October 20, 2026; the torrent and the DDoSecrets copy persist.

RDAP shows hexane.cc registered on October 15, 2026, through NiceNIC International Group — five days before the DDoSecrets publication stamp. Single-purpose domain, short lead time, no personal attribution on the wire.

Hacktivism, Not an Insider Job?

Security researcher Mirko Ross of Asvin examined the breach and told heise online: “This doesn’t look like an insider job to me, but rather hacktivism.” Attackers quoted via a Telegram channel said their goal was “not destruction,” since they could have destroyed servers and backups, but to expose the party’s “degeneracy and hypocrisy.” They said they got in through an “outdated website,” and told “International Cyber Digest” they were later offered money to take the leak site down and hit with a DDoS.

Shared infrastructure — Cloudflare, cock.li, Monero — is privacy tooling here, not a fingerprint tying Hexane to any named person. Treat ubiquitous services as cover, not as attribution.

Scope of the Leak: What Hexane Published

DDoSecrets filed the release on October 20, 2026, under Germany, type “Extremist, Fascist,” source “Hexane.cc,” download size 281.00 GB. Its summary: “Internal material from the far-right German party Alternative für Deutschland… more than half a million emails, attachments, documents, invoices, member records, contracts, and databases which reveal allegations of embezzlement and financial misconduct.”

OctoProbe counted the bytes Hexane listed. MANIFEST.tsv enumerates 102,985 files totaling 301,876,945,879 bytes — 281 GB when measured the same way DDoSecrets does. Hexane’s journalist briefing gives the working tallies reporters will use: about 421,000 messages across ten mailboxes; about 48,700 documents; about 14,500 tabular exports; about 39,000 images; plus WordPress and SQL dumps.

What Is in the Directory Tree?

Hexane’s corpus README is a legend, not marketing copy:

• 01_EMAIL/ — mailbox archives in standard mbox format (a mailbox file format most mail clients and forensic tools open), one directory per mailbox, split into roughly 4 GB parts. Sixty files, 209.67 GB.
• 04_TABULAR_DATA/ — CSV, TSV, JSON and JSONL exports (form submissions, member tables, logs). 14,484 files, 29.02 GB.
• 03_DOCUMENTS/ — PDFs, Office, OpenDocument, RTF. 48,725 files, 26.14 GB (including 42,295 PDFs in the manifest).
• 06_MEDIA/ — photographs and scans from mail attachments. 39,145 files, 10.11 GB.
• 02_DATABASES/ — SQL and WordPress dumps, four files totaling 5.65 GB (including a 3.03 GB full SQL dump and WordPress packages).
• 05_CREDENTIALS_AND_KEYS/ — password hashes, SSH keys, TLS keys, config secrets. 560 files, 0.56 GB.
• 99_FOR_JOURNALISTS/ — start-here briefing, data dictionary, search recipes, verification notes. Five small files.

Email is most of the disk. Documents and tables are most of the file count. Credentials are a small folder with outsized implications — see Access below.

Which Ten Mailboxes?

Hexane’s briefing lists the ten boxes that “happened to be on the systems reached.” Sizes below are from the manifest (largest first):

Hexane flagged the arbitration courts as “the most under-reported part of this archive” — internal expulsions, appeals and disputes the party would not volunteer. Bild, via DW, put the published email count above 420,000 and said material included mail tied to co-leader Alice Weidel plus bank statements, certificates and membership lists. This article does not open those records; it maps the container.

What Did Hexane Tell Journalists?

The 99_FOR_JOURNALISTS/ pack is the tell that this was built for reporters, not for scrapers alone. Hexane’s briefing warns of three traps (paraphrased, attributed to Hexane): do not confuse a political position with misconduct; do not attribute forwarded or third-party material to the party — check the sender line; a document is not a finding — the finding is the relationship it proves.

On integrity, Hexane says MANIFEST.tsv lists every file and size in bytes so a downloader can confirm a complete copy. On limits, it calls the archive partial; records reflect systems at acquisition and may be incomplete, duplicated or superseded; personal data appears as in the originals, some about private individuals; “Nothing in this archive is a legal finding… Verify before publishing.”

On verification, Hexane’s guidance is blunt: the website is an index of summaries, not a primary source; the torrent holds original mbox messages byte-for-byte; authenticate with DKIM-Signature (a cryptographic mail signature that proves the message passed a domain’s mail server — origin and integrity, not authorship or truth), Received chains, Message-ID, and cross-checks across independent files. “Nothing on this site replaces that, and nothing on this site should be cited as a primary source.”

Access: How Deep the Compromise Went

Scope describes what left the building. Access asks how far inside the operators got.

How Did They Say They Got In?

Attackers said they entered through an “outdated website,” heise online reported. The same piece says several web servers and at least one mail server were the source of the unauthorized copies. That is a web-to-mail (and likely web-to-database) path, not a single misplaced USB stick.

Does AfD’s “Mostly Inactive” Claim Hold?

AfD confirmed the incident. A spokesperson told reporters hackers targeted a hosting provider and copied data from “a small number of mostly inactive email accounts,” and that the theft happened in September; the party said it stopped the attack after discovering it. heise noted the contradiction: published data running into early September includes communications about the Mecklenburg-Western Pomerania state-election campaign and the mailbox of Leif-Erik Holm, the AfD’s top candidate there. A live campaign inbox is not an attic account.

Deutsche Welle reported the party launched an inquiry; archived versions of the Hexane site showed 281 GB under the headline “The party’s own records, unedited”; and nothing had yet been certified authentic by an independent body. Context around the party — several state chapters classified “confirmed right-wing extremist” by German domestic intelligence, the party topping recent national polls, ban calls from some politicians — is the political weather, not proof of any document inside the dump.

What Do Credentials and Databases Say About Depth?

Mailbox exports alone would be a serious breach. Hexane shipped more.

02_DATABASES/ holds multi-gigabyte SQL and WordPress dumps — the kind of exports that usually require administrative or host-level reach on the systems that ran them. 05_CREDENTIALS_AND_KEYS/ holds 560 files Hexane labels as password hashes, SSH keys, TLS keys and configuration secrets: manifest names include WordPress config credential extracts, JWT and session-token analyses, PEM private-key material, per-vhost profiles, and dozens of host-named JSON packs tied to AfD web properties. That folder is only 0.56 GB. It is evidence of how deep the operators went once they were in — not a claim, in this article, about any specific password or key.

Put the three access signals together: an “outdated website” entry story; multi-server sourcing (web plus mail); and a publish set that spans live political mail, arbitration-court mail, shop mail, SQL/WordPress databases and a credentials harvest. The compromise, on that evidence, was not a single idle inbox. It was system-level enough to empty mail stores, database exports and secret material into one torrent.

How This Story Was Reported

This assessment is built from Hexane’s own corpus documentation (README.md, README_FOR_JOURNALISTS.md, VERIFY.md, DONATE.txt, MANIFEST.tsv), the public DDoSecrets publication page and file index, contemporaneous reporting by heise online (Falk Steiner) and Deutsche Welle (citing Bild), live DNS and RDAP for hexane.cc, and an OctoProbe infrastructure graph of already-public Hexane nodes. DDoSecrets is also the publisher of the Trump-transition archive covered separately. It does not quote private-individual personal data from inside the mailboxes, and it does not treat the archive’s unverified contents as adjudicated findings.

Frequently Asked Questions

Who is Hexane?

Hexane is an anonymous publisher that released a 281 GB archive of Alternative für Deutschland internal records via hexane.cc, BitTorrent and a DDoSecrets mirror. It presents itself as an independent document archive and contacts media only through a cock.li address and PGP.

How large is the Hexane AfD archive?

Hexane’s MANIFEST.tsv lists 301,876,945,879 bytes across 102,985 files — 281 GB as DDoSecrets reports. Hexane’s journalist briefing counts about 421,000 messages across ten mailboxes, plus tens of thousands of documents, tabular exports and images.

How did attackers say they got into AfD systems?

According to heise online, attackers said they entered through an outdated website. heise reported that several web servers and at least one mail server were the source. AfD said mostly inactive mailboxes hosted by a provider were stolen in September; published material running into early September, including a live state-campaign mailbox, undercuts that downplaying.

Is this an insider leak?

Security researcher Mirko Ross of Asvin told heise online it does not look like an insider job, but rather hacktivism. Attackers quoted via Telegram said their goal was “not destruction” but to expose the party’s “degeneracy and hypocrisy.”

Colin Aamot is an investigative journalist and OSINT domain expert specializing in FOIA and public records. A technologist, U.S. Army veteran, and former Capitol Hill staffer, he has held director roles across the private and public sectors.Full bio