Overview
- The ATF said it is responding to a cybersecurity incident that affected a standalone, segmented system and that it disconnected the environment and launched forensic and incident‑response actions.
- Senior Department of Justice officials designated the event a “major incident,” which triggers higher levels of federal notification and investigative coordination.
- The Qilin ransomware group listed the ATF on its dark‑web leak site claiming the agency as a victim, but the group has not posted verifiable evidence and the agency has not attributed the incident to Qilin.
- ATF said the impacted system is separate from its enterprise network and that there is no indication the agency’s enterprise services or mission operations were affected.
- Key details remain unknown because forensics are ongoing: ATF has not identified the specific system, disclosed when it discovered the incident, or confirmed whether any data were accessed or stolen.