Ransomware Attack Targets ATF as Russian Cyber Gang Qilin Claims Responsibility
The U.S. Department of Justice (DOJ) confirmed on Wednesday that the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) was hit by a ransomware attack. The Russian cybercriminal group Qilin claimed responsibility, raising concerns over the potential exposure of sensitive gun owner data.
The attack was first flagged by Gun Owners of America (GOA), which posted on social media that Qilin had breached the ATF, though the extent of any data theft remains unclear. The ATF maintains a vast digital repository reportedly containing at least 866 million records from federally licensed firearms dealers fueling long-standing criticism from Second Amendment advocates who argue the agency has effectively created a backdoor gun registry.
The National Rifle Association (NRA) expressed alarm over the breach, stating it was working with the administration to assess the scope and severity of the incident. William Sack of the Second Amendment Foundation emphasized the risks of government-held gun owner data, citing repeated security failures.
The breach occurred amid heightened cybersecurity tensions, as the DOJ announced the same day that it had seized multiple domains linked to QTFY, a Chinese state-sponsored hacking group accused of deploying malware against U.S. critical infrastructure, including NASA, the Federal Reserve, the Department of Energy, and the U.S. Senate.
The attack followed a surprise trip to Russia by CIA Director John Ratcliffe, as reported by The Wall Street Journal. No direct connection between the two events has been established. The DOJ has not disclosed further details on the ATF breach or Qilin’s demands.
Source: https://www.bizpacreview.com/2026/08/26/atf-hit-by-ransomware-attack-doj-says-1656487/
Bureau of Industry and Security-U.S. Department of Commerce cybersecurity rating report: https://www.rankiteo.com/company/bureau-of-industry-and-security-u-s-department-of-commerce
"id": "BUR1787977472",
"linkid": "bureau-of-industry-and-security-u-s-department-of-commerce",
"type": "Ransomware",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Gun owners, federally licensed '
'firearms dealers',
'industry': 'Law Enforcement/Regulatory',
'location': 'United States',
'name': 'Bureau of Alcohol, Tobacco, Firearms and '
'Explosives (ATF)',
'type': 'Government Agency'}],
'data_breach': {'number_of_records_exposed': '866 million',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (personally identifiable '
'information related to gun ownership)',
'type_of_data_compromised': 'Sensitive gun owner data, '
'records from federally licensed '
'firearms dealers'},
'description': 'The U.S. Department of Justice (DOJ) confirmed that the '
'Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) was '
'hit by a ransomware attack. The Russian cybercriminal group '
'Qilin claimed responsibility, raising concerns over the '
'potential exposure of sensitive gun owner data. The attack '
'was first flagged by Gun Owners of America (GOA), which '
'posted on social media that Qilin had breached the ATF, '
'though the extent of any data theft remains unclear.',
'impact': {'brand_reputation_impact': 'Heightened concerns from Second '
'Amendment advocates and organizations '
'like the NRA and Second Amendment '
'Foundation',
'data_compromised': 'Sensitive gun owner data, at least 866 '
'million records from federally licensed '
'firearms dealers',
'identity_theft_risk': 'Potential risk due to exposure of '
'sensitive gun owner data'},
'references': [{'source': 'U.S. Department of Justice (DOJ)'},
{'source': 'Gun Owners of America (GOA)'},
{'source': 'The Wall Street Journal'}],
'stakeholder_advisories': 'National Rifle Association (NRA) and Second '
'Amendment Foundation are assessing the scope and '
'severity of the incident.',
'threat_actor': 'Qilin',
'title': 'Ransomware Attack Targets ATF as Russian Cyber Gang Qilin Claims '
'Responsibility',
'type': 'Ransomware'}