ATF Takes Breached System Offline After Qilin Ransomware Claims
ATF investigates breach claimed by Qilin ransomware; affected system isolated for analysis.
Event / Security
ATF Cybersecurity Breach
The Bureau of Alcohol, Tobacco, Firearms and Explosives disclosed a cybersecurity incident affecting a standalone system classified as a 'major incident' by Justice Department officials. The Qilin ransomware gang claimed responsibility, though without providing evidence. The affected system remains isolated from ATF's enterprise network with no indication of broader compromise or operational disruption.
1 reported locations
Daily activity
1 articles0 articles
2026-08-27 to 2026-11-08 · UTC publication dates
Coverage begins 27 Aug, 04:04 UTC
Follow the documented timeline or explore the related reporting.
What happened
Qilin ransomware group claims responsibility for ATF breach
The Qilin ransomware gang claimed ATF as a victim on its leak site, according to cybersecurity publications monitoring the group's activities. Qilin has not publicly released evidence to substantiate the claim, and ATF has not linked the incident to the ransomware group. Breach-monitoring service GalaxyWarden reported that ATF appeared on Qilin's leak site with claims of obtained files, but GalaxyWarden noted it had not independently verified the group's assertions.
ATF operations unaffected by cybersecurity incident
The cybersecurity incident has not disrupted ATF operations or affected the agency's ability to carry out its missions, according to the agency. Required notifications under federal guidelines have been completed.
ATF probes cybersecurity incident involving standalone system
The Bureau of Alcohol, Tobacco, Firearms and Explosives announced it is investigating a cybersecurity incident affecting a standalone system. Senior Justice Department officials designated the incident as a "major incident" under federal guidelines. The affected system is isolated from ATF's main enterprise network, and the agency found no evidence the breach reached its broader network, eForms platform, or other ATF systems.
ATF takes affected system offline for forensic analysis
After identifying the cybersecurity issue, ATF took the affected environment offline and began forensic analysis and incident-response work. The agency is coordinating with the Justice Department to examine the scope and cause of the incident. Officials have not disclosed the specific system involved, when the incident was first detected, or whether any information was accessed, removed, or stolen.
Read the coverage
2 alternative perspectives