ATF Investigating “Major” Cybersecurity Breach as Ransomware Group Claims Responsibility

Federal authorities are examining a cybersecurity breach affecting an isolated system at the Bureau of Alcohol, Tobacco, Firearms and Explosives, which Justice Department leadership has formally classified as a “major incident” under federal protocols. The agency revealed Wednesday that it has launched forensic investigations and incident-response operations following discovery of the breach.

Qilin, an established ransomware operation, has claimed the ATF as its latest target, according to multiple cybersecurity firms monitoring the group’s public leak site. Neither the ransomware group nor cybersecurity analysts have presented verifiable evidence to support the claim, and federal investigators have not yet attributed the incident to any specific threat actor.

The ATF confirmed that the compromised system operates independently from its main enterprise network, with no evidence suggesting the breach extended to critical infrastructure including the agency’s eForms platform or other connected systems. Personnel isolated the affected environment immediately upon detection and initiated containment procedures in coordination with Justice Department officials.

Officials have declined to disclose the identity of the targeted system, the discovery timeline, or whether sensitive data was accessed or exfiltrated. The agency stated that operations have continued uninterrupted and that the breach has not compromised its ability to execute core missions.

The ATF is requesting information from the public regarding the incident and has directed potential sources to contact the ATF Tipline at 1-888-283-8477.