The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed Wednesday that one of its systems was compromised after the Qilin ransomware gang listed the agency on its dark web data leak portal. The ATF — the federal agency responsible for enforcing laws governing firearms, explosives, and arson — published a statement describing the intrusion as a “major incident.” Qilin did not specify at the time whether it had stolen files or issued a ransom demand to the agency.
According to ATF’s statement, the breach affected a standalone system, not ATF’s core operational infrastructure. The agency said it immediately terminated connections to the affected environment and launched incident response and forensic activities upon discovery. The Department of Justice is coordinating with ATF to investigate the full scope of the breach. Qilin has previously targeted hospitals, schools, and critical infrastructure in the United States, United Kingdom, and Australia, making it one of the more aggressive ransomware groups currently active.