Qilin Ransomware Group Claims ATF as Latest Victim in "Major Incident" The Russia-linked ransomware group Qilin has added the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) to its list of victims, labeling the breach a "major incident." The ATF confirmed the attack, disclosing that a standalone system containing investigation target data separate from its core networks was compromised. The agency detected the intrusion, disconnected the affected systems, and engaged cybersecurity experts while notifying the Department of Justice (DOJ). Federal guidelines have classified the event as a "major incident," though the ATF emphasized that its enterprise network, eForms system, and other critical infrastructure remain unaffected. Qilin, known for its 2024 attack on UK pathology provider Synnovis, also listed Northern Leasing Systems, Metal Conversions, California Truck Equipment, and WireCo as victims on its leak site. However, the group has not disclosed the type or volume of stolen data, nor provided samples a common tactic in ransomware operations. The ATF, which investigates federal crimes including illegal firearms trafficking, explosives, arson, and organized crime, has not specified the targeted system but confirmed it held sensitive investigative information. The breach underscores the persistent threat posed by state-aligned ransomware groups to high-profile government and private-sector targets.