The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is investigating a cybersecurity incident that senior Justice Department officials have designated a "major incident" under federal guidelines. The disclosure comes as the Qilin ransomware group claimed the ATF as a victim, according to cybersecurity outlets tracking the group's activity. However, the group has not publicly provided evidence to substantiate its claim, and the ATF has not attributed the incident to Qilin.
The ATF stated that the affected system operates separately from its main enterprise network and that there is no indication the incident has impacted the agency's broader network, its eForms system, or any other ATF systems. Upon discovering the incident, the agency disconnected the affected environment and initiated forensic and incident-response efforts. The ATF is collaborating with the Justice Department in its investigation.
The agency has not identified the specific system that was compromised, the timeline of discovery, or whether any data was accessed or stolen. Cybersecurity news outlets reported that Qilin claimed the ATF as its latest victim, but offered no supporting details or evidence. A breach-monitoring service, GalaxyWarden, also reported that the ATF appeared on Qilin's leak site, with the group asserting it had obtained files from the agency, though GalaxyWarden has not independently verified these assertions.
Senior Justice Department officials designated the cybersecurity event a "major incident" according to federal guidelines, and all required notifications have been made. The ATF indicated that the incident has not disrupted its operations or affected its ability to carry out its missions. The agency has requested that anyone with information related to the incident contact the ATF Tipline at 1-888-ATF-TIPS or 1-888-283-8477.