ATF investigating ‘major’ cybersecurity incident

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) on Wednesday announced an investigation into a “major” cybersecurity incident that the Qilin ransomware group claimed responsibility for.

The ATF said a stand-alone system operating separately from the agency’s network did not appear to affect its enterprise network, eForms system or other systems, according to a statement . It also noted that senior Department of Justice (DOJ) officials designated the occurrence as a “major incident” under applicable federal guidelines.

“Upon discovery of the incident, ATF immediately terminated connections to the affected environment and initiated incident‑response and forensic activities,” the agency said. “ATF is coordinating closely with the Department of Justice to investigate.”

The ATF did not confirm or mention that Qilin was responsible, nor did it say when the incident took place or what data was stolen. However, the Russia-linked hacker group took credit for the hack, listing the ATF along with five other victims in the manufacturing and industrial sectors on its dark web site early Wednesday, Cybernews reported .

The outlet added that if Qilin’s claim is legitimate, the result of stealing any amount of data from the ATF “could be enormous.”

The DOJ also announced Wednesday that it seized the hacking platforms QScan and QTRouter, which were operated by a state-run group employed by the Chinese-based firm Nanjing Xinjiuwei Network Technology Co.

These platforms targeted the DOJ, NASA, Federal Reserve, Department of Energy, U.S. Senate, Department of Health and Human Services and National Institutes of Health, according to a court affidavit unsealed in the Southern District of California.

“State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted,” Attorney General Todd Blanche said in a statement.

“We are here to ensure security for the American people and will use every tool we have to keep that promise,” he added.