ATF Declares ‘Major Incident’ After Breach of Standalone System Holding Investigation Data

The Bureau of Alcohol, Tobacco, Firearms and Explosives has confirmed a cyberattack on a standalone computer system holding information about targets of its investigations, and senior officials have designated it a “major incident” under federal guidelines. The confirmation came Wednesday, the same day the Qilin ransomware gang added ATF to its leak site.

“The standalone system was not connected to any other ATF systems, including any case management systems, laboratory systems, or eForms systems, and it was quickly shut down when the breach was discovered,” an ATF spokesperson told Recorded Future News. In a public statement that evening, the agency said officials “immediately terminated connections to the affected environment and initiated incident‑response and forensic activities,” and that the attack didn’t affect its ability to carry out its missions. The Justice Department is investigating.

Why “major incident” matters

The label is a formal, legally defined classification. As TechCrunch explained, major incidents are significant cyber incidents likely to cause demonstrable harm to U.S. national security or broader U.S. interests, and agencies have to notify Congress within a week of discovering one. The ATF joins other agencies that have made the same declaration, including the U.S. Marshals Service after a 2023 ransomware attack and the FBI after a breach earlier this year that exposed phone numbers of surveillance targets.

An unproven claim from an active gang

Qilin’s leak-site post included only the ATF’s name, with no sample of stolen data. The group runs a ransomware-as-a-service operation, leasing its tools to affiliates for a cut of the proceeds. It was one of the most active ransomware operations of 2025, with victims ranging from Kuala Lumpur International Airport and Japanese beverage maker Asahi to the Texas city of Sugar Land and several Texas power companies. Researchers ranked it the second most active gang in July, with 127 reported attacks.

ATF hasn’t said how attackers got in or what data, if any, was taken. For security teams, the early lesson is that the system’s isolation appears to have done its job: the breach stayed contained to one machine instead of reaching the bureau’s core network.