ATF confirms "major incident" after Qilin ransomware group claims breach

ATF System Compromised

The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed that one of its standalone systems was compromised. This confirmation follows claims made by the Qilin ransomware group, which added the ATF to its dark web data leak portal.

Incident Details and Response

The ATF described the event as a "major incident" and is investigating it in collaboration with the Department of Justice. Upon discovery, the agency immediately terminated connections to the affected environment and initiated incident-response and forensic activities. The impacted system operates separately from the main ATF enterprise network, and there is no indication that the incident affected the ATF eForms system or any other core ATF system.

Operational Impact and Public Appeal

The ATF stated that the incident did not affect the agency's operations. The agency has asked the public to share any information regarding the attack through its official tipline.

About Qilin Ransomware

Qilin is a Ransomware-as-a-Service (RaaS) operation, first identified in August 2022 under the name "Agenda." The group has claimed responsibility for over 2,200 victims on its dark web leak site, including organizations such as Nissan, Yangfeng, Synnovis, Asahi, Lee Enterprises, and Australia's Court Services Victoria.

Broader Context of Government Breaches

This incident follows other cybersecurity breaches disclosed by U.S. federal agencies this year. The FBI confirmed in March it was investigating a breach affecting systems for wiretap and surveillance warrants. In July, the Department of Homeland Security disclosed a cyberattack that compromised the Homeland Security Information Network (HSIN).