DOJ Confirms ATF Hit by Qilin Ransomware Attack, Raising Concerns Over Gun Owner Data
The U.S. Department of Justice (DOJ) confirmed on Wednesday that the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) was targeted in a ransomware attack, with the Russian cybercriminal group Qilin claiming responsibility. The incident has sparked alarm among Second Amendment advocates over the potential exposure of sensitive gun owner data.
The attack was first flagged by Gun Owners of America (GOA), which warned that the ATF maintains a registry of over 1 billion firearms and gun owners. While the extent of the breach remains unclear, the agency holds at least 866 million digitized records from federally licensed firearms dealers (FFLs), a database long criticized by pro-gun groups as a "backdoor gun registry."
The National Rifle Association (NRA) expressed concern over the privacy risks, stating it is working with the administration to assess the scope of the incident. William Sack of the Second Amendment Foundation emphasized the vulnerability of such data in government hands, arguing that the breach underscores the need to minimize the ATF’s collection of gun owner information.
The attack occurred amid heightened cybersecurity tensions, just one day after CIA Director John Ratcliffe’s surprise trip to Russia. Separately, the DOJ announced the seizure of multiple domains linked to QTFY, a Chinese state-sponsored hacking group accused of deploying malware against U.S. critical infrastructure, including NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate.
No details on ransom demands or data exfiltration have been disclosed, but the incident highlights ongoing risks to federal agencies handling sensitive records.
Source: https://www.aol.com/articles/atf-hit-ransomware-attack-doj-211028000.html
ATF cybersecurity rating report: https://www.rankiteo.com/company/atf
"id": "ATF1787790603",
"linkid": "atf",
"type": "Ransomware",
"date": "8/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Gun owners (potentially '
'millions)',
'industry': 'Law Enforcement',
'location': 'United States',
'name': 'Bureau of Alcohol, Tobacco, Firearms and '
'Explosives (ATF)',
'type': 'Government Agency'}],
'data_breach': {'number_of_records_exposed': 'Over 1 billion firearms and gun '
'owner records (866 million '
'digitized records confirmed)',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (personally identifiable '
'information of gun owners)',
'type_of_data_compromised': ['Firearms records',
'Gun owner data']},
'description': 'The U.S. Department of Justice (DOJ) confirmed that the '
'Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) was '
'targeted in a ransomware attack by the Russian cybercriminal '
'group Qilin. The incident has raised concerns over the '
'potential exposure of sensitive gun owner data.',
'impact': {'brand_reputation_impact': 'Heightened concerns among Second '
'Amendment advocates and pro-gun groups',
'data_compromised': 'Potential exposure of sensitive gun owner '
'data',
'identity_theft_risk': 'Risk of exposure of gun owner data'},
'ransomware': {'ransomware_strain': 'Qilin'},
'references': [{'source': 'U.S. Department of Justice (DOJ)'},
{'source': 'Gun Owners of America (GOA)'},
{'source': 'National Rifle Association (NRA)'},
{'source': 'Second Amendment Foundation'}],
'stakeholder_advisories': 'NRA and Second Amendment Foundation are working '
'with the administration to assess the scope of the '
'incident.',
'threat_actor': 'Qilin (Russian cybercriminal group)',
'title': 'ATF Hit by Qilin Ransomware Attack',
'type': 'Ransomware'}