Reported by 3 outlets

Timeline

1. original reporting

   ATF investigating ‘major’ cyber incident after ransomware group claim

   malware.news · 47d ago · August 27th, 2026

   The Bureau of Alcohol, Tobacco, Firearms and Explosives is https://www.atf.gov/news/press-releases/atf-responds-to-cybersecurity-incident ”>investigating a cybersecurity event affecting one of its systems, which Justice Department officials have designated a “major incident” under federal guidelines. The disclosure came after the ransomware group Qilin listed ATF on its dark-web leak site and claimed to have compromised the agency. ATF has not attributed the incident to Qilin or said whether ransomware was involved. The bureau, housed within the Justice Department, said the affected system operates separately from its main computer network. The agency found no indication that the incident spread to its broader network, its electronic firearms application platform or any other ATF system. The eForms platform allows members of the firearms industry and the public to electronically submit applications involving weapons regulated under the National Firearms Act, including silencers, short-barreled rifles and machine guns. The Record DOJ firearms agency says hackers breached system containing investigation targets | The Record from Recorded Future News ”>reported the intrusion before ATF https://www.atf.gov

2. update from malware.news

   Qilin claimed they attacked the ATF. Here’s what the ATF says

   malware.news · 47d ago · August 27th, 2026

   As many people have heard by now, the Qilin ransomware group claimed to have attacked the ATF. As is their regular practice, they provided no proof of their claims. Today, the ATF has issued a statement that sheds light on the incident and what ATF has found so far: WASHINGTON – The Bureau of Alcohol,… Source Article Link: https://databreaches.net/2026/08/27/qilin-claimed-they-attacked-the-atf-heres-what-the-atf-says/

3. mentioned by securityweek.com

   ATF Confirms Cyber Incident After Ransomware Group Claims Attack

   securityweek.com · 46d ago · August 28th, 2026

4. update from cyberscoop.com

   ATF confirms cyberattack hit system containing info on its investigation targets

   cyberscoop.com · 46d ago · August 28th, 2026

   The Bureau of Alcohol, Tobacco, Firearms and Explosives insists the cyberattack that it publicly disclosed Wednesday was limited to investigation targets, and has not impacted other agency systems. ATF said it is responding to the breach , which first became public after a prolific ransomware group claimed it accessed the federal agency’s network “The incident involved a standalone computer system containing information about targets of ATF investigations,” Tanya Roman, ATF’s public affairs chief, told CyberScoop in an email. “The standalone system was not connected to any other ATF systems, including any case management systems, laboratory systems, or eForms systems, and it was quickly shut down when the breach was discovered,” Roman added. Qilin, a financially-motivated threat group composed of Russian-speaking operators, claimed responsibility for the attack, but its involvement hasn’t been independently confirmed. The group has claimed hundreds of victims from more than 60 countries since 2022 and became one of the most active ransomware threats globally by mid-2025, according to Halcyon. ATF declined to comment on Qilin’s alleged involvement, the root cause of the attack or when it occurred. “This is an ongoing investigation, and no further details can be shared at this time,” Roman said. The federal law enforcement agency, which is under the Justice Department, said senior official