[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-atf-confirms-ransomware-incident-on-investigation-data-system":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},5908,"atf-confirms-ransomware-incident-on-investigation-data-system","ATF Confirms Ransomware Incident on Investigation Data System","The federal firearms agency disconnected a standalone system after ransomware group Qilin claimed the breach, though core ATF networks appear untouched.","The ATF got hit by ransomware, and this time it's the agency chasing gun traffickers that's on defense.\n\nThe Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a \"major incident\" after Russia-linked ransomware group Qilin listed it on a dark-web leak site alongside four other victims: Northern Leasing Systems, Metal Conversions, California Truck Equipment, and WireCo. Qilin hasn't published stolen files or said what it took. ATF says the breach hit only a standalone system separate from its main enterprise network, its eForms system, and other core infrastructure. The agency disconnected the affected system, brought in outside cybersecurity help, and notified the Department of Justice, which designated the incident a major one under federal guidelines.\n\nATF hasn't named the compromised system, but it has been described elsewhere as one holding information on targets of ATF investigations, a detail the agency's own statement stops short of confirming. If accurate, that is a far more sensitive exposure than a typical corporate breach: identities tied to open investigations into gun trafficking, arson, and organized crime. It also fits a pattern of ransomware crews using the threat of leaked sensitive files, not just locked systems, to pressure targets who would otherwise refuse to pay.\n\nQilin has form here. It's the same group blamed for the 2024 attack on pathology provider Synnovis, which disrupted blood testing across UK hospitals for months. A federal law enforcement agency joining that victim list says less about ATF's specific defenses than about how routine hitting government targets has become for ransomware operators.","[\"ransomware\",\"government\",\"cybersecurity\",\"atf\"]","2026-08-28T15:10:00.000Z","2026-08-28T15:31:12.099Z","2026-08-28T15:31:23.996Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"publisher-r1","publisher",1,"The article contains an unattributed factual claim ('a spokesperson who spoke with The Register') embedded as if sourced by this outlet, which is a sourcing\u002Fattribution error that needs to be fixed or properly cited before publishing.","resolved","security",[32,33,34,35],"ransomware","government","cybersecurity","atf",[37],{"name":38,"url":39},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fus-government-alcohol-and-firearms-agency-atf-declares-major-incident-after-ransomware-gang-claims-cyberattack",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",3351,"2026-08-30T14:51:33.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",503,"2026-08-29T10:30:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",244,"2026-08-30T15:35:10.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",148,"2026-08-27T15:33:14.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",91,"2026-08-20T10:01:48.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Startups","startups",52,"2026-08-25T18:55:12.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]