The Bureau of Alcohol, Tobacco, Firearms and Explosives says intruders reached an isolated computer holding information about subjects of its investigations, in an event senior US Department of Justice officials classified as a major incident. The disclosure followed the appearance of the agency on the Russia-linked Qilin ransomware crew's leak site, which gave no data description, volume, or samples. The Justice Department is investigating, while ATF says operations continue and its enterprise network and eForms system show no sign of impact.

Isolated investigative system accessed

ATF described the affected asset as a standalone computer system that was not linked to other agency systems. The machine held information about targets of ATF investigations, according to the agency's public notice.

In the same notice, the agency said there was no sign of spread to the ATF enterprise network, the ATF eForms system, or any other ATF system. ATF, which operates under the US Department of Justice, said normal operations were not affected.

Containment and DOJ investigation

The agency said it cut off connectivity to the impacted IT environment promptly after discovery and is working in close coordination with the DOJ to examine the intrusion.

An ATF spokesperson declined to discuss Qilin's assertions, any ransom demand, the volume or type of data taken, or the intrusion method, citing an ongoing investigation. Senior Justice Department officials applied the federal major incident designation to the compromise.

Leak-site listing and Qilin context

The leak-site listing emerged shortly before ATF published its notice. The entry did not identify what information was allegedly taken, how much was involved, or offer proof files.

Qilin was previously linked to the 2024 attack on pathology provider Synnovis that disrupted NHS services in the UK. The group was among the most active ransomware operations in July, according to Comparitech, which reported 799 ransomware incidents that month, up from 668 in June, with 125 attributed to Qilin. Additional context on that surge is available in July ransomware activity analysis.

Technical background

This section is general explanation only and does not describe this specific ATF event.

Many current ransomware operations use double extortion: encrypt systems for ransom while threatening to publish stolen files on a leak site to increase pressure. A listing alone therefore does not confirm data theft, scope, or authenticity without samples, file trees, or victim-system telemetry.

Generic defensive workflow for this class of event typically involves isolating affected hosts, preserving volatile evidence, hunting for lateral movement, and reviewing external exposure:

# Generic illustrative examples only — not from this incident
# Isolate a host at the OS level and list recent logins
who /var/log/wtmp | tail
ss -tulpn
# Search for large outbound transfers or archiving activity
find / -type f -name "*.7z" -o -name "*.rar" 2>/dev/null | head