Atf Responds To Cybersecurity Incident

www.atf.gov • September 14, 2026

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( ) or https:// means you’ve safely connected to the .gov website. sensitive information only on official, secure websites.

ATF responds to cybersecurity incident

WASHINGTON - The Bureau of Alcohol, Tobacco, Firearms and Explosives is responding to a cybersecurity incident affecting a standalone system. The impacted system operates separately from the ATF enterprise network, and there is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system.

Upon discovery of the incident, ATF immediately terminated connections to the affected environment and initiated incident‑response and forensic activities. ATF is coordinating closely with the Department of Justice to investigate.

Senior Department officials have designated the event a “major incident” under applicable federal guidelines, and required notifications have been completed.

The incident has not impacted ATF’s ability to perform its missions.

ATF encourages anyone with information related to this incident to submit a tip through the ATF Tipline at 1-888-ATF-TIPS ( 1-888-283-8477 ).

An official website of the U.S. Department of Justice

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Qilin Ransomware Gang Claims Attack on ATF, Major Incident Declared The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is investigating a major cybersecurity incident after the Qilin ransomware gang claimed responsibility for breaching one of its standalone systems. The ATF confirmed that the affected system operates separately from its main network and has not impacted its broader operations or eForms system. Although Qilin listed the ATF as a victim on its dark web leak site, the agency has not confirmed whether data was stolen or if a ransom was demanded. The incident has been designated a 'major incident' by the Department of Justice, which triggers formal reporting requirements. ATF has initiated forensic investigations and disconnected the affected system to prevent further access. This incident follows a series of cyberattacks on federal agencies in 2026, raising concerns about the security of sensitive government data. 26 sources 61

Extracted Entities

Companies (1)

Bureau Of Alcohol, Tobacco, Firearms And Explosives