ATF confirms data breach after ransomware group claims attack

Key facts

• The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a data breach.
• The Qilin ransomware group claimed responsibility for the attack.
• The compromised system contained information on ATF investigation targets.
• The ATF declared the incident a 'major incident,' requiring congressional notification.
• The affected system was isolated and shut down.

The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a data breach after the Qilin ransomware group claimed responsibility for an attack on a system containing information about investigation targets. The ATF stated that the compromised system was standalone, isolated from its main network, and was shut down shortly after the breach was discovered.

The incident has been formally classified as a 'major incident,' a designation that mandates notification to Congress within a week due to potential harm to national security or U.S. interests. The Department of Justice is coordinating with the ATF on the investigation.

Qilin, a ransomware operation believed to be Russian-based or Russian-speaking, has claimed responsibility for approximately 2,400 attacks across more than 100 countries since its emergence in October 2022. This incident places the ATF among several government agencies that have experienced major cyber incidents in recent years.