The ATF Was Just Hit by a ‘Major’ Hacker Breach—And Investigation Targets Were Exposed
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives is responding to a serious cybersecurity and ransomware event.
Another federal agency has been hit by a severe data breach.
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) announced earlier this week that it is responding to a cybersecurity breach that department officials labeled a “major incident.” It’s a serious designation, meaning the event “is likely to result in demonstrable harm” to national security, foreign relations, the economy, civil liberties, or public health and safety, according to guidelines established by the Cybersecurity and Infrastructure Security Agency (CISA). The agency did not share much detail about what was compromised, but a spokesperson revealed that the breached computer system contained information about investigation targets.
“The incident involved a standalone computer system containing information about targets of ATF investigations,” the ATF spokesperson said in a statement. “The standalone system was not connected to any other ATF systems, including any case management systems, laboratory systems, or eForms systems, and it was quickly shut down when the breach was discovered.”
The ATF is a law enforcement agency charged
The ATF is a law enforcement agency charged with protecting U.S. communities from violent crime associated with arson and the use of firearms and explosives. It is also responsible for dismantling drug and weapons trafficking networks and enforcing policies around sales of cigarettes, vapes, and alcohol. The department notes in its announcement that the compromised system was “standalone,” and that it is not connected to the core internal system the agency uses for communication, daily operations, and data storage. ATF also specifically noted that the eForms system, which firearm owners and the industry use to electronically file paperwork, was not affected.
Weekly roundup of the latest in tech news
An Inc.com Featured Presentation
Ransomware.live, a website that tracks ransomware events for awareness and research purposes, noted that the Qilin ransomware group had claimed responsibility for the attack.
Ransomware is a type of malware that infects a victim’s system and locks up integral data, software, and systems. Attackers then demand a ransom in exchange for restoring access to the files or preventing broader release. When hackers both encrypt data and threaten to release it, it is called “double extortion,” which is the model by which Qilin typically operates. The group dates back to 2022 and has been linked to attacks that predominantly target U.S.-based organizations in professional services and manufacturing. It has also been tied to attacks on 94 government and defense organizations, according to Ransomware.live.
The ATF disclosed that the incident has not
The ATF disclosed that the incident has not affected its ability to conduct necessary functions, and that it is coordinating closely with the Department of Justice. The spokesperson declined to comment on whether the agency had confirmed that Qilin was responsible or whether it was mulling a ransom payment.
CISA notes that ransomware is an “ever-evolving” form of malware, and criminals are constantly switching up their approach to attack. The ATF announcement, for example, follows closely on the heels of an alert CISA published together with the FBI and the U.S. Department of Health and Human Services about another ransomware variant, Medusa.
Medusa developers and affiliates have targeted more than 500 victims between 2021, when law enforcement first identified it, and April 2026. Its victims span “a variety of critical infrastructure sectors,” but health care companies and organizations have been repeatedly targeted.
Get 1 Smart Business Storydelivered straight to your inbox when you subscribe to Inc.’s free daily newsletter.
Source: www.inc.com
