ATF responds to 'major' cybersecurity incident after ransomware gang's claims

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) said it’s responding to a “major” cybersecurity incident shortly after the Qilin ransomware gang posted the US federal law enforcement agency on its leak site. An ATF spokesperson told The Register the intruders accessed a “standalone computer system containing information about targets of ATF investigations” that wasn’t connected to any other ATF systems. “There is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system,” according to a statement posted on the firearms agency’s website. The spokesperson declined to answer any additional questions about the breach, including Qilin’s claims, the ransom demand, and what data was stolen or how much. “ATF is unable to comment due to an ongoing investigation,” the spokesperson said. ATF, which is housed under the US Department of Justice, said it’s “coordinating closely” with the DOJ to investigate the breach, and “immediately” blocked connections to the affected IT environment upon discovering the incident. The statement said the security breach had not affected ATF’s operations and noted that senior Justice Department officials designated the compromise as a “major incident” under federal guidelines. Shortly before ATF posted its security-incident notice on its website, Russia-linked Qilin ransomware criminals listed the firearms agency on its leak site. The post, seen by The Register and shared on social media, did not say what data Qilin claimed to have stolen, how much, or provide samples to substantiate the claim. Qilin, the notorious crew behind the 2024 attack on pathology provider Synnovis that disrupted NHS services in the UK, was one of the most prolific ransomware gangs in July, according to Comparitech. The firm, which reviews cybersecurity products and provides data analysis, counted 799 ransomware incidents last month, up from 668 in June. Qilin claimed 125 of those.® Editor's note: This story was amended post-publication with comment from ATF.