ATF confirms “major incident” after recent Qilin breach claims

The ATF confirmed that a standalone system was breached following claims by the Qilin ransomware gang, which added the ATF to its dark web data leak portal. The ATF stated the impacted system operates independently from its enterprise network and other critical systems such as the eForms system. Upon discovery, ATF terminated connections to the affected environment and initiated incident response and forensic activities. The agency is coordinating with the Department of Justice to investigate the incident. Qilin is a known Ransomware-as-a-Service group active since 2022 with over 2,200 victims globally. The breach does not appear to have affected ATF’s operational capabilities or core networks.

A standalone ATF system was compromised, but there is no evidence that the ATF enterprise network, eForms system, or other critical systems were impacted. ATF operations remain unaffected. The breach is considered a major incident and is under active investigation. No ransom demand or data theft confirmation has been publicly disclosed by ATF or Qilin. The incident highlights exposure to ransomware threat actors but currently shows limited operational impact on ATF.

ATF has already terminated connections to the affected environment and initiated incident response and forensic activities. The agency is working closely with the Department of Justice to investigate the breach. No further public mitigation steps are currently recommended. The incident is contained to a standalone system separate from core networks. Organizations should monitor official advisories for updates.