The US Bureau of Alcohol, Tobacco, Firearms and Explosives is investigating a “major” cybersecurity incident after the Qilin ransomware gang listed the agency on its leak site. The ATF says the breach affected an isolated system and that there is currently no evidence of impact on its main network, eForms system or operational activities; the Justice Department is assisting the investigation.

The agency says it immediately blocked connections to the affected environment, while senior Justice Department officials classified the compromise as a major incident under federal rules. Qilin has not disclosed what it allegedly stole or supplied evidence, but it was linked to the 2024 Synnovis attack that disrupted NHS services; it claimed 125 of 799 ransomware incidents recorded in July.