The US Bureau of Alcohol, Tobacco, Firearms and Explosives said in a press release, as reported by BleepingComputer (27 August), that a standalone system was breached in what it described as a 'major incident', which it is investigating with the Justice Department. BleepingComputer quotes ATF as saying the impacted system operates separately from the ATF enterprise network, that there is no indication the incident has affected the enterprise network, the ATF eForms system or any other ATF system, that on discovery ATF immediately terminated connections to the affected environment and initiated incident-response and forensic activities, and that it is coordinating closely with the Justice Department to investigate; BleepingComputer adds that ATF said the incident did not affect the agency's operations.

BleepingComputer reported that Qilin added ATF to its data leak portal on 26 August without saying whether it had stolen files or demanded a ransom, and that ATF published its press release the same day. Actor claims are not treated as verified facts on Cyberstack.

UPDATE (25 Oct 2026): ATF said on X on 31 August that it is aware of claims about the possible publication of data allegedly obtained in the incident, which involved a standalone system used in connection with CALEA; that it is working with the Justice Department and other federal partners to assess the claims; that the affected system was separate from ATF's enterprise network; and that it has not confirmed the authenticity, nature or scope of the materials. (source: ATF on X)

Correction (26 Oct 2026): ATF's press release cannot be read by Cyberstack, so its text is now credited to BleepingComputer, which quotes it; an earlier correction saying the release was readable and was the primary source was wrong.

Details that BleepingComputer does not report (the release's printed date, the designation of the event by senior Department officials, completed notifications and a statement about ATF's missions) and an unlinked SecurityWeek credit have been removed.

The card date has moved from 28 to 27 August 2026, the date of BleepingComputer's report.

Earlier, on 25 Oct, we removed SecurityWeek's description of the Qilin post and credited the listing to BleepingComputer. (source: BleepingComputer)

Correction (28 Oct 2026): BleepingComputer's report and ATF's X post show times with no time zone, so the card now gives their dates only (27 and 31 August) and drops the Perth and US-time conversions; the card date stays 27 August. (sources: BleepingComputer; ATF on X)