ATF says it is investigating claim by Qilin ransomware group after “major” cybersecurity incident

The Bureau of Alcohol, Tobacco, Firearms and Explosives has launched an investigation into a cybersecurity incident described by the agency as “major” after the Qilin ransomware group claimed responsibility, the Justice Department component said Wednesday.

In its public statement, ATF said the incident involved a standalone system that was operating separately from the agency’s network. The bureau said it did not appear that the standalone system affected ATF’s enterprise network, its eForms system, or other systems.

ATF said investigators were working to determine what happened, whether any data was accessed, and what remediation steps, if any, are needed. The bureau’s communication framed the inquiry as an effort to confirm the scope and impact of the incident and to understand how it occurred.

The announcement also underscores that ATF relies on multiple technology systems to carry out federal alcohol, tobacco, firearms, and explosives enforcement responsibilities. Among the systems it highlighted was eForms, the bureau’s online platform used to submit and process certain regulatory forms, which ATF said was not affected.

Separately, Qilin’s claim of involvement is part of an ongoing pattern in which ransomware groups publicly post statements about attacks and data access. ATF’s statement did not adopt the group’s assertions as fact, instead describing its own investigative process and the bureau’s initial internal assessment of the technical separation between the impacted standalone system and the broader environment.

ATF’s investigation comes as federal agencies continue to face persistent cybersecurity threats, including ransomware activity and intrusion attempts. In that context, the bureau said it is reviewing the incident to assess whether there are any operational consequences for its systems, including those used for regulatory processing and enforcement-related workflows.

ATF did not provide a timetable for concluding the investigation in the initial announcement. The bureau’s next steps, as described in its statement, center on determining the incident’s scope, confirming whether any systems or data were affected, and identifying any corrective actions required to prevent recurrence.