US government alcohol and firearms agency ATF declares ‘major incident’ after ransomware gang claims cyberattack

Ransomware group Qilin lists Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) among new victims, claiming a “major incident”
ATF confirmed breach of a standalone system holding investigation target data, not core networks
Systems were disconnected, DOJ notified; Qilin is Russia‑linked, known for past Synnovis attack

The US Government’s Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has suffered a “major incident” in which it appears to have lost sensitive information.

Notorious ransomware operators Qilin added a handful of new names to their data leak site: Northern Leasing Systems, Metal Conversions, California Truck Equipment, Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), and WireCo.

The attackers did not say what kind of data they stole, or how much of it they have. They have also not posted any samples of the stolen files, which is not that uncommon these days.

ATF investigations

Shortly after appearing on Qilin’s data leak site, ATF confirmed the news via a press release published on the agency’s website. In the announcement, ATF said it was responding to an incident, “affecting a standalone system”.

“The impacted system operates separately from the ATF enterprise network, and there is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system,” the press release reads. While the press release does not mention the name of the targeted system, a spokesperson told The Register it contains information about targets of ATF investigations.

The ATF usually investigates federal crimes such as illegal firearms trafficking, violent crime and gangs, explosives, arson and bombings, organized crime, illegal alcohol and tobacco trafficking, and firearms dealers and manufacturers.

After spotting the attack, ATF disconnected the affected systems, engaged cybersecurity experts, and notified relevant authorities, including the Department of Justice. “Senior Department officials have designated the event a “major incident” under applicable federal guidelines, and required notifications have been completed,” ATF added.

Qilin is a relatively old, known ransomware threat actor. It is being tied to Russia and is best known for its attack on the pathology provider Synnovis, which happened back in 2024.