SecurityWeek (28 August 2026) reports the US Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a cybersecurity incident after the Qilin ransomware group listed the agency.

ATF's statement, as quoted there, says the intrusion hit a standalone system that was disconnected once discovered, that the system sits apart from the ATF enterprise network, and that there is no indication the enterprise network, eForms, or any other ATF system was affected or that ATF cannot perform its missions. An investigation is underway with the Justice Department; senior DOJ officials designated the event a major incident under federal guidelines and required notifications were completed.

BleepingComputer (27 August) reported that Qilin added ATF to its data leak portal on 26 August without saying whether it had stolen files or demanded a ransom. Actor claims are not treated as verified facts on this desk.

ATF's press-release URL returns 403 to this desk; ATF's statement is quoted by SecurityWeek and BleepingComputer.

Correction (25 Oct 2026): Removed SecurityWeek's description of the Qilin leak-site post (that it made no specific claims, showed no screenshots and set no leak timer): it described the gang's post rather than a confirmed fact and is out of date.

The listing itself is now credited to BleepingComputer, which also quotes ATF's statement. (source: BleepingComputer)

UPDATE (25 Oct 2026): ATF said on X on 31 August (US time) that it is aware of claims about the possible publication of data allegedly obtained in the incident, which involved a standalone system used in connection with CALEA; that it is working with the Justice Department and other federal partners to assess the claims; that the affected system was separate from ATF's enterprise network; and that it has not confirmed the authenticity, nature or scope of the materials. (source: ATF on X)