US government alcohol and firearms agency ATF declares ‘major incident’ after ransomware gang claims cyberattack

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), a US government agency, has declared a "major incident" following a ransomware attack. The hackers, known as Qilin, are believed to be linked to Russia and have claimed responsibility for the breach. Qilin added the ATF to a list of victims on their data leak site, alongside other companies such as Northern Leasing Systems, Metal Conversions, California Truck Equipment, and WireCo.

The exact nature and amount of stolen data remain unknown, as Qilin has not released any samples. Initially, the ATF confirmed the breach occurred in a standalone system, separate from their main enterprise network and ATF eForms system. The agency disconnected the affected systems, engaged cybersecurity experts, and notified relevant authorities, including the Department of Justice.

An ATF spokesperson stated that the impacted system contained information about targets of ATF investigations, which include federal crimes such as illegal firearms trafficking, violent crime, gangs, explosives, arson, organized crime, illegal alcohol and tobacco trafficking, and firearms dealers and manufacturers. Qilin is a long-standing ransomware threat actor with ties to Russia, and is infamous for its attack on pathology provider Synnovis in 2024.