US firearms agency ATF confirms 'major incident' as Qilin ransomware gang lists it as a victim
The Bureau of Alcohol, Tobacco, Firearms and Explosives says a standalone system was breached. Qilin added ATF to its dark web leak site the same day.
Key points
- The US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed this week that one of its systems was broken into, calling it a "major incident".
- The Qilin ransomware gang, a criminal group that locks victims' files and demands payment, listed ATF on its dark web leak site the same day.
- ATF says the affected system runs separately from its main network and its eForms system for firearms paperwork was not touched.
- Qilin has claimed more than 2,200 victims since it appeared in August 2022, among them Nissan, Yangfeng, Synnovis and Lee Enterprises.
- The US Department of Justice is investigating alongside ATF.
The federal agency that polices gun and explosives laws has confirmed one of its systems was broken into, calling the intrusion a "major incident" in a public notice this week.
Qilin posted ATF to its dark web leak portal the same day. The gang didn't say what it stole or name a ransom figure.
What actually happened?
Attackers got into a single ATF system sitting apart from the agency's main network. Staff spotted the problem, cut the connection immediately and called in forensic investigators. The Department of Justice is now running the inquiry alongside ATF.
"The impacted system operates separately from the ATF enterprise network, and there is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system," the agency said. The eForms portal is where Americans file firearms paperwork, so its status matters to dealers and buyers. ATF says day-to-day operations weren't disrupted and has asked anyone with information to contact its official tipline. BleepingComputer first reported that questions sent to an ATF spokesperson had not been answered.
Who is Qilin?
Qilin is a ransomware-as-a-service operation: the core gang builds the file-locking malware and rents it to other criminals who split any ransom paid. Our July explainer covers how that model works. Researchers first spotted Qilin in August 2022 under the name "Agenda". It's since become one of the busiest extortion operations running, with more than 2,200 named victims on its leak site.
| Notable Qilin victims | Sector |
|---|---|
| Nissan | Automotive |
| Yangfeng | Auto parts |
| Synnovis | UK pathology |
| Asahi | Japanese beverages |
| Lee Enterprises | US publishing |
| Court Services Victoria | Australian courts |
Should the public be worried?
Probably not directly, based on what ATF has said so far. The agency insists its main network is untouched and eForms is running, so background checks and firearms paperwork should continue normally. If that changes, dealers will hear about it first.
What's still unknown is whether Qilin took anything from the standalone system. Investigators typically need weeks to answer that. Licensed dealers, informants and applicants whose records may sit on ATF systems should watch for unusual mail or phishing attempts, where criminals send fake messages to trick people into handing over passwords or money.
A pattern at US federal agencies
ATF isn't the first federal body to disclose a breach this year. In early March, the FBI confirmed an intrusion affecting systems tied to wiretap and surveillance warrants. Then in July, the Department of Homeland Security disclosed an attack on the Homeland Security Information Network, a platform used to share sensitive tips with state, local and private-sector partners.
Three serious federal incidents in nine months points to attackers finding gaps at the edges of government networks, in the smaller systems that attract less hardening than the crown jewels. Qilin's claim, if it holds, fits that pattern exactly. The gang's appetite for high-profile targets shows no sign of slowing, which is the detail worth watching here.
