The US Bureau of Alcohol, Tobacco, Firearms and Explosives said in a press release, as reported by BleepingComputer (27 August), that a standalone system was breached in what it described as a 'major incident', which it is investigating with the Justice Department. BleepingComputer quotes ATF as saying the impacted system operates separately from the ATF enterprise network, that there is no indication the incident has affected the enterprise network, the ATF eForms system or any other ATF system, that on discovery ATF immediately terminated connections to the affected environment and initiated incident-response and forensic activities, and that it is coordinating closely with the Justice Department to investigate; BleepingComputer adds that ATF said the incident did not affect the agency's operations.

BleepingComputer reported that Qilin added ATF to its data leak portal on 26 August without saying whether it had stolen files or demanded a ransom, and that ATF published its press release the same day. Actor claims are not treated as verified facts on Cyberstack.

Correction (26 Oct 2026): ATF's press release cannot be read by Cyberstack, so its text is now credited to BleepingComputer, which quotes it; an earlier correction saying the release was readable and was the primary source was wrong.

Details that BleepingComputer does not report (the release's printed date, the designation of the event by senior Department officials, completed notifications and a statement about ATF's missions) and an unlinked SecurityWeek credit have been removed.

The card date has moved from 28 to 27 August 2026, the date of BleepingComputer's report.

Earlier, on 25 Oct, we removed SecurityWeek's description of the group's post and credited the listing to BleepingComputer. (source: BleepingComputer)

Correction (28 Oct 2026): BleepingComputer's report shows times with no time zone, so the card now gives its date only (27 August) and drops the Perth and US-time conversions; the card date stays 27 August. (source: BleepingComputer)

Correction (05 Nov 2026): removed the ransomware group's claim from the title, so the card gives it only in the credited sentence above; removed ATF's post on X as a source; removed details no other source gives. (source: BleepingComputer)