The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives has confirmed a cyberattack affecting a standalone computer system and said the incident has been formally classified as a “major incident.” The affected system contained information about targets of ATF investigations, while the agency says there is no indication that its broader network, eForms platform, or other systems were affected.
The ransomware group Qilin has claimed responsibility for the attack on its leak site, although it has not provided public evidence supporting that claim. ATF has not attributed the breach to Qilin or disclosed whether data was stolen.
ATF Is Investigating With the Justice Department
In its official statement, ATF said it disconnected the affected environment after discovering the incident and began forensic and incident-response work. The agency is coordinating its investigation with the U.S. Department of Justice.
ATF said the incident has not affected its ability to carry out its missions. It has not disclosed when the breach began, how attackers gained access, or what information may have been accessed.
An ATF spokesperson said the compromised standalone system contained information about targets of agency investigations. The spokesperson did not provide further details about the data involved.
‘Major Incident’ Designation Requires Congressional Notification
Under federal cybersecurity rules, a major incident is a significant event that meets criteria established under the Federal Information Security Modernization Act. Agencies are required to report qualifying incidents to Congress within seven days of identifying them.
ATF said senior Justice Department officials designated the breach a major incident and that the required notifications have already been completed.
Qilin Claims Responsibility Without Providing Evidence
Qilin operates a ransomware-as-a-service model that provides ransomware tools to criminal affiliates in exchange for a portion of any payments. The group listed ATF on its leak site but did not initially publish samples of allegedly stolen files or disclose whether it demanded a ransom.
Qilin has previously claimed attacks against organizations including Lee Enterprises and U.K. pathology provider Synnovis.
The ATF incident follows other major cyber incidents involving U.S. law enforcement agencies. The U.S. Marshals Service declared a major incident following a 2023 ransomware attack, while the FBI disclosed another major cyber incident in 2026 involving systems used for surveillance-related information.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.