ATF responds to ‘major’ cybersecurity incident after ransomware gang’s claims
Developed over time first seen 2 months ago
The ATF has confirmed a cybersecurity breach classified by senior Justice Department officials as a “major incident”, after the Qilin ransomware gang listed the agency on its leak site. The agency says the intrusion affected an isolated computer system holding information on targets of ATF investigations, with no indication that its enterprise network, eForms service or operations were affected.
ATF says it immediately cut connections to the affected environment and is investigating with the Justice Department. Qilin has not disclosed what data it allegedly obtained, demanded or provided evidence of its claim; the Russia-linked group was also responsible for the 2024 Synnovis attack that disrupted NHS services.
- ATF confirms a major breach of an isolated investigative system
- Core ATF systems and operations reportedly remain unaffected
- Qilin has not substantiated its claimed data theft
New here? Start with this
The Bureau of Alcohol, Tobacco, Firearms and Explosives, known as the ATF, is a US federal law-enforcement agency within the Justice Department. It investigates crimes involving firearms, explosives, arson, alcohol and tobacco, and supports other agencies with specialist work.
A ransomware attack is when criminals break into computer systems, often lock or steal data, and demand payment. Some groups also threaten to publish information they say they have taken, using leak websites to put pressure on victims.
Qilin is a ransomware group that has previously been linked to attacks on organisations in several countries, including the 2024 cyberattack on the NHS supplier Synnovis. Cybersecurity incidents involving government bodies can raise questions about the security of official data and whether services or investigations could be affected.