ATF investigates major cyber breach, Qilin group claims attack

The ATF is investigating a cybersecurity incident on a standalone system, designated a major incident by the Justice Department. The Qilin ransomware group has claimed the attack, but ATF has not confirmed attribution. The agency disconnected the affected system and is coordinating with the DOJ.

The ATF's disclosure confirms the incident triggered the Justice Department's major incident classification, which carries mandatory notification requirements under federal guidelines. The agency has not identified which standalone system was affected, when the breach was discovered, or whether any data was accessed or stolen, leaving key details unresolved.

The Qilin ransomware group's claim, tracked by cybersecurity monitoring services, has not been backed by public evidence. ATF has neither confirmed nor denied the group's involvement. The affected system operates separately from the agency's enterprise network, and ATF states its eForms system and broader operations remain unaffected, with the environment disconnected during forensic review.