The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed this week that it experienced a cyberattack affecting a standalone system that contained information on targets of its investigations. The agency stated that the incident was isolated and did not impact its critical operations or other internal systems.
The ransomware group Qilin has claimed responsibility for the attack, though the ATF has not independently confirmed their involvement. The agency declined to comment on the group's claims, the specific timing of the attack, or its root cause, citing an ongoing investigation. The ATF publicly disclosed the incident hours after Qilin's claims surfaced.
According to Tanya Roman, the ATF's public affairs chief, the compromised system was not connected to any other ATF networks, including case management, laboratory, or eForms systems. Upon discovery of the breach, the system was immediately shut down. The agency maintains that its ability to perform its core missions remains unaffected.
Senior officials within the Department of Justice, which oversees the ATF, have designated the event as a major incident and completed necessary notifications.
Qilin, a financially motivated group of Russian-speaking operators, has been active since 2022 and emerged as a prominent ransomware threat globally by mid-2025. The group operates an affiliate-based model and has claimed hundreds of victims across more than 60 countries, with a significant portion in the United States. Their targets span various sectors, including manufacturing, healthcare, financial services, education, and government.
The FBI reported Qilin as one of the top five most frequently reported ransomware variants to its Internet Crime Complaint Center last year, and Google also identified it as a highly active ransomware brand in 2025. While Qilin has previously targeted government entities, a claimed attack against a federal law enforcement agency like the ATF could signal an escalation in their targeting scope. The group's objectives in this specific incident remain unclear, especially given the unlikelihood of a ransom payment from a federal agency.
