ATF declares 'major incident' after ransomware gang claims responsibility for hack

The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) announced that a cyberattack on one of its systems has been formally classified as a 'major incident' — a legal designation that requires notifying lawmakers in Congress.

The agency said it is responding to an attack on a standalone system that is separate from its main network. An ATF spokesperson told reporters that the affected computer system held information including the targets of ATF investigations.

TechCrunch has seen a claim of responsibility posted on the leak site of the Qilin ransomware gang. However, the group has not provided evidence to support its claim, such as a sample of the allegedly stolen data. Qilin is known for operating a 'ransomware-as-a-service' business, leasing its hacking tools to other criminal affiliates in exchange for a cut of any profits. The gang has previously listed media company Lee Enterprises and U.K. pathology lab operator Synnovis among its targets.

What qualifies as a 'major incident'

Under federal law, a 'major incident' covers significant cyber incidents likely to cause demonstrable harm to U.S. national security or broader U.S. interests. Agencies are required to disclose such incidents to Congress within a week of discovery.

The ATF joins a list of government agencies that have declared major incidents following breaches in recent years, including a 2023 ransomware attack on a system used by the U.S. Marshals Service and, earlier this year, a breach of an FBI system that exposed phone numbers of surveillance targets.