The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) in the U.S. has announced that a cyber intrusion affecting one of its systems has been classified as a “major incident.” This designation triggers an official notification to members of Congress.
According to the ATF, they are actively addressing the cyber incident impacting a specific standalone system that operates independently from the bureau’s main network. A representative for the ATF informed the press that the compromised system housed data related to “targets of ATF investigations.”
Reports indicate that the Qilin ransomware group has claimed responsibility for this attack on their leak site, although they have not substantiated their claim with any tangible evidence, such as leaked data samples. Known for its “ransomware-as-a-service” model, Qilin provides its hacking tools to other criminals for a share of the earnings. The group has also targeted major entities like media organization Lee Enterprises and the U.K.-based pathology laboratory, Synnovis.
According to federal law, “major incidents” refer to significant cyber events that may lead to considerable damage to U.S. national security or other vital interests. Federal agencies must report these incidents to Congress within a week of their detection.
The ATF’s announcement aligns with recent occurrences among various government entities that have classified similar incidents as major breaches, including a 2023 ransomware attack on a system utilized by the U.S. Marshals Service and a breach earlier this year involving the FBI, where phone numbers of surveillance targets were exposed.
