Threats · 45 days ago
ATF confirmed a cybersecurity incident after Qilin put the agency on its leak site, and the Bureau of Alcohol, Tobacco, Firearms and Explosives said the affected standalone system was disconnected once the intrusion was found. The Justice Department has designated the event a federal major incident and is investigating with ATF.
ATF says the isolated system sat outside the enterprise network, the eForms system, and other ATF systems, and that its missions were not affected. The key detail is what the box held: ATF previously told Recorded Future News it contained information about ATF investigation targets, so a contained compromise can still expose sensitive case material even when the main network stays clean.
For federal law-enforcement shops that keep investigative or evidence data on separate systems, the blast radius is defined by what those systems store, not by whether the enterprise network was reached. The reporting still does not show what Qilin took or whether it will publish anything, so the exposure question remains centered on the data already known to have been on the standalone node.
5 sources covering this story
ATF confirms cyberattack hit system containing info on its investigation targets
The prolific ransomware group Qilin claimed responsibility for the attack.
ATF Confirms Cyber Incident After Ransomware Group Claims Attack
The Bureau of Alcohol, Tobacco, Firearms and Explosives has described it as a ‘major incident’ and it’s conducting an investigation with the DOJ.
ATF responds to 'major' cybersecurity incident after ransomware gang's claims
US Justice Department investigating the breach
The Record from Recorded Future
DOJ firearms agency says hackers breached system containing investigation targets
The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed it experienced a cyberattack on a system containing investigation information, as a prolific ransomware gang claimed to have carried out the breach.
ATF confirms “major incident” after recent Qilin breach claims
ATF, the regulatory agency that enforces federal laws governing firearms and explosives in the United States, has confirmed that one of its systems was compromised after breach claims made by the Qilin ransomware gang.
Part of the PlainSec briefing for 2026-08-31