AfD Leak: The Trail Leads to the US — Who’s Behind the Hackers?

TVS News AI, editorially supervised, presents AfD Leak: The Trail Leads to the US — Who’s Behind the Hackers.

The crucial limitation is already evident in the first available lines: The excerpt was created on 06.11.2026. It shows a photo caption with AfD leader Weidel and an X account that is supposed to contain “details about the data leak.” The actual SPIEGEL research, however, remains hidden behind the paywall in this excerpt.

That is more than a technical footnote. Without the actual passages, it is impossible to verify what technical trail the reporters found, how reliable it is, or whether it points only to a location, an environment or a single individual. This is precisely where a report on a data leak either provides an initial indication or already establishes the identity of those responsible.

The Accessible Source Text Names Weidel’s X Account

The documented connection

The caption expressly mentions an “X account with details about the data leak” belonging to AfD leader Weidel. The connection between the SPIEGEL article and a public account is therefore documented. What this account actually shows, however, is not reproduced in the provided text.

That distinction is easily lost in the rush to spread the story. A reference to an account proves that there was a public presentation concerning the data leak. It proves neither that all the information spread there is accurate nor that the individuals named there were actually involved in accessing data. For a reliable assessment, the exact content of the posts would need to be compared with the research findings.

The missing core of the research

The excerpt contains no technical details. It provides no information about a specific attack vector, credentials used, a software vulnerability, affected accounts or a technical link to individuals. The scope of the published data is not stated either.

Accordingly, no reliable statement can be derived from the available material such as: Hundreds of thousands of emails have been online since a particular point in time. Such details may be striking, but they are not covered by this source text. The more accurate formulation is therefore: The SPIEGEL article places Weidel’s statements in the context of a data leak; the research itself is not readable here.

Why Paywall Access Details Do Not Close the Gap

What the excerpt reveals about access to the article

SPIEGEL points to a possible reason for the missing text: The linked article is either more than 30 days old or has already been opened 10 times. These are concrete details about access status, but they provide no clues about the content of the research.

The subscription options offered also explain the blocked full text. For new customers, the page lists 1 euro for 4 weeks, followed by 6.49 euros per week. Anyone who wants to read the full article must therefore expect to unlock the text through the payment model; the present excerpt does not contain the crucial passages.

The publicly visible link leads to the SPIEGEL article on the suspected hackers behind the AfD data leak. It is therefore the right place to compare the original research with the visible preliminary material.

A US Trail Requires More Than a Geographical Indication

The draft mentions a connection to the US and an online scene there. In the provided source text, however, these two statements do not appear in a readable sentence from the research. It would therefore be irresponsible to infer from them a confirmed group of perpetrators, state involvement or a specific technical origin.

Even if a technical trail led to a US IP address, a server or a known online group, it would initially provide only a starting point for further investigations. An IP address does not automatically prove the identity of the person behind it. Conversely, an American trail would not constitute evidence of political or state direction either. This second limitation is important because neither conclusion is supported by the information provided.

The strongest reliable statement therefore remains narrow: The excerpt connects an X account belonging to AfD leader Weidel with details about a data leak and refers to SPIEGEL+ research on suspected hackers. The specific trail, its reach and the identity of those responsible cannot be determined from the accessible source material.

What a Reliable Sequence Requires

First, the original passages

A reliable answer requires the complete SPIEGEL text. The decisive factor is which technical features the reporters name and whether those features point exclusively to a location or environment, or also identify a specific person or group.

Then, separate indications from evidence

A public statement, a server location or a technical trail can narrow the circle of possible participants. But it does not automatically answer questions about authorship, instructions, motives or the technical sequence of events. Each of these questions must be answered using an independent source.

Finally, verify the comparison

Until that comparison is available, the report should not refer to a “confirmed perpetrator.” The wording suspected hackers reflects the identifiable degree of uncertainty. It is not a watered-down version of a sure finding, but marks exactly the boundary between a trail and an identity.