Ransomware gang claims ATF hack; agency declares major incident

The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives has declared a 'major incident' following a cyberattack on a stand-alone system containing investigation targets. The Qilin ransomware gang has claimed responsibility, though it has not provided evidence. Federal law requires agencies to notify Congress of such incidents within a week.

The affected system operates independently from the ATF's main network, a design choice that may have limited the blast radius of the intrusion. Bureau officials have not disclosed how many records were involved or whether the data was exfiltrated, only confirming that the system held information on individuals under investigation.

Qilin's claim lacks the customary proof of access, such as sample files or screenshots, which some researchers view as a possible bluff or an attempt to gain notoriety. The gang's ransomware-as-a-service model means the actual operators could be affiliates rather than core members. The ATF incident mirrors recent breaches at the U.S. Marshals Service and the FBI, both of which triggered the same formal declaration.