ATF investigates ‘major’ cybersecurity incident as ransomware group claims attack
Developed over time first seen 2 months ago
The ATF is investigating a cybersecurity incident involving a standalone system that senior Justice Department officials have classified as a “major incident” under federal guidelines. The Qilin ransomware group has claimed the agency as a victim, but the claim has not been independently verified and ATF has not attributed the incident to the group; the classification indicates that federal officials consider the event significant.
ATF said the affected system was separate from its main enterprise network, with no indication that its wider network, eForms service or other agency systems were affected. The agency disconnected the environment and began forensic and incident-response work with the Justice Department, while saying operations continued normally; it has not identified the system, stated when it discovered the incident, or confirmed whether data was accessed or stolen. Breach-monitoring services reported that Qilin alleged it obtained agency files, but said they could not verify this assertion.
- ATF is investigating a formally designated major cyber incident.
- Qilin claims responsibility, but the allegation remains unverified.
- ATF says core systems and operations were unaffected.
New here? Start with this
The Bureau of Alcohol, Tobacco, Firearms and Explosives, known as the ATF, is a US federal law-enforcement agency within the Justice Department. It investigates offences involving firearms, explosives, arson, alcohol and tobacco, and works with other police agencies across the country.
A cybersecurity incident is an event that may affect computer systems, such as unauthorised access, disruption or theft of information. In the US government, an incident can be classed as “major” when officials believe its potential impact requires high-level coordination and investigation.
Ransomware groups are criminal networks that break into computer systems, steal or encrypt data, and often demand payment. They sometimes publicly name alleged victims to pressure them, but such claims do not by themselves prove that an attack occurred or that files were taken.