The Bureau of Alcohol, Tobacco, Firearms and Explosives is investigating a cybersecurity incident affecting a standalone system, which senior Justice Department officials have classified as a “major incident”. The Qilin ransomware group has claimed responsibility, but neither the ATF nor independent monitors have verified that claim, and the agency says its main network and services remain unaffected.

The ATF disconnected the affected environment and began forensic and incident-response work with the Justice Department. It has not said which system was involved, when the incident was found, or whether data was accessed or stolen; it says there has been no disruption to operations, including its eForms system.