ATF Ransomware Attack

ATF confirmed the breach on 26 August 2026 and notified Congress on 27 August after senior Justice Department officials designated it a "major incident". The affected system held information on targets of ATF investigations. ATF says it was not connected to case management, laboratory or eForms systems, and was shut down when the breach was found. The Russian-speaking Qilin gang claimed the attack. Cybernews later reported that Qilin had leaked files it said exposed ATF criminal investigations.

Qilin is a Russian-speaking ransomware-as-a-service operation active since 2022, with hundreds of victims in more than 60 countries.

Countries affected

• United States

Data types

• Information on investigation targets

Political impact

Mandatory congressional notification under the "major incident" rules.

Significance

Exposure of federal investigation targets to a criminal gang.

Publishing organisations

• TechCrunch
• CyberScoop
• Cybernews
• SecurityWeek

Related events

• 2026-shinyhunters-fbijobs-breach-claim

References

1. [1]TechCrunch: https://techcrunch.com/2026/08/27/atf-declares-major-incident-as-ransomware-gang-claims-hack/
2. [2]CyberScoop: https://cyberscoop.com/atf-doj-cyberattack-qilin-ransomware/
3. [3]Cybernews: https://cybernews.com/cybercrime/atf-qilin-ransomware-cyberattack-data-leak-investigations/