The group posted ATF’s name on its leak site on a Wednesday. By the end of the same day, the agency had confirmed that something was wrong.
BleepingComputer reported on August 27, 2026 that the Bureau of Alcohol, Tobacco, Firearms and Explosives, which enforces federal firearms and explosives laws, had acknowledged a breach of one of its systems. The ransomware gang Qilin had added the bureau to its dark web data leak portal, though it did not say whether it had taken any files or asked for a ransom.
What ATF said
In a press release issued that day, ATF called the event a “major incident” and said it was investigating alongside the Department of Justice. The affected machine was a standalone system, the agency said, and it ran separately from ATF’s enterprise network.
“There is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system,” the agency said. Once staff found the intrusion, it “immediately terminated connections to the affected environment” and began incident-response and forensic work.
ATF also said the incident did not affect its operations, and it asked the public to send any information about the attack to its official tipline. BleepingComputer contacted an ATF spokesperson with further questions but had no answer when it published.
The group named
Qilin runs a ransomware-as-a-service operation. It was first spotted in August 2022 under the name “Agenda,” and its leak site now lists more than 2,200 victims. Nissan and Yangfeng, the pathology services provider Synnovis, Japanese brewer Asahi, publisher Lee Enterprises and Australia’s Court Services Victoria are among them.
ATF is not the first federal body to disclose an attack this year. The FBI confirmed in early March that it was investigating a breach of systems used to manage wiretap and surveillance warrants. In July, the Department of Homeland Security disclosed an attack that compromised the Homeland Security Information Network, a platform used by federal, state, local and private-sector partners to share sensitive information.
